theory Schedule_C

lemma schedule_ccorres:
  "ccorres dc xfdc invs' UNIV [] schedule (Call schedule_'proc)" supply Collect_const [simp del] supply prio_and_dom_limit_helpers[simp] supply Collect_const_mem [simp] 
  (* FIXME: these should likely be in simpset for CRefine, or even in general *)
   supply from_bool_eq_if[simp] from_bool_eq_if'[simp] from_bool_0[simp] if_1_0_0[simp]
         ccorres_IF_True[simp] apply (cinit) apply (rule ccorres_pre_getCurThread) apply (rule ccorres_pre_getSchedulerAction) apply wpc 
     (* toplevel case: action is resume current thread *)
      apply (rule ccorres_cond_false_seq) apply simp apply (rule_tac P=\<top> and P'="{s. ksSchedulerAction_' (globals s) = NULL }" in ccorres_from_vcg) apply (clarsimp simp: return_def split: prod.splits) apply (rule conseqPre, vcg, clarsimp) 
    (* toplevel case: action is choose new thread *)
     apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr 
    (* ct runnable? *)
     apply (ctac add: isRunnable_ccorres, rename_tac runnable) apply (clarsimp simp: to_bool_def) apply (rule ccorres_split_nothrow_dc) 
         (* enqueue if runnable *)
          apply (simp add: when_def) apply (rule ccorres_cond[where R=\<top>], clarsimp) apply csymbr apply (ctac add: tcbSchedEnqueue_ccorres) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (clarsimp, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (rule ccorres_cond_true_seq) 
        (* isolate haskell part before setting thread action *)
         apply (simp add: scheduleChooseNewThread_def) apply (rule ccorres_lhs_assoc)+ apply (rule ccorres_split_nothrow_dc) apply (simp add: bind_assoc) apply (ctac add: scheduleChooseNewThread_ccorres) apply (ctac(no_simp) add: ccorres_setSchedulerAction) apply (wpsimp simp: cscheduler_action_relation_def
                 | vcg exspec=scheduleChooseNewThread_modifies exspec=tcbSchedEnqueue_modifies)+ 
   (* toplevel case: action is switch to candidate *)
    apply (rename_tac candidate) apply (rule_tac P="\<lambda>s. ksSchedulerAction s = SwitchToThread candidate \<and> invs' s" in ccorres_cross_over_guard) apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr 
   (* ct runnable? *)
    apply (ctac add: isRunnable_ccorres, rename_tac runnable runnable') apply (clarsimp simp: to_bool_def) apply (rule ccorres_split_nothrow_dc) 
        (* enqueue if runnable *)
         apply (simp add: when_def) apply (rule ccorres_cond[where R=\<top>], clarsimp) apply csymbr apply (ctac add: tcbSchedEnqueue_ccorres) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (clarsimp, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (rule ccorres_cond_false_seq) apply (rule_tac xf'=was_runnable_' in ccorres_abstract, ceqv) apply (rename_tac was_runnable') apply (rule_tac P="was_runnable' = runnable'" in ccorres_gen_asm2, clarsimp) apply (rule ccorres_symb_exec_l3[OF _ git_wp _ empty_fail_getIdleThread], rename_tac it) apply (rule ccorres_pre_threadGet, rename_tac targetPrio) apply (rule ccorres_pre_threadGet, rename_tac curPrio) apply (rule ccorres_rhs_assoc)+ apply (rule_tac xf'=candidate_' and val="tcb_ptr_to_ctcb_ptr candidate"
                 and R="\<lambda>s. ksSchedulerAction s = SwitchToThread candidate" and R'=UNIV
                 in ccorres_symb_exec_r_known_rv) apply (rule conseqPre, vcg, clarsimp) apply (fastforce dest!: rf_sr_cscheduler_relation simp: cscheduler_action_relation_def) apply ceqv 
         (* split off fastfail calculation *)
          apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule_tac r'="\<lambda>rv rv'. rv = to_bool rv'" and xf'=fastfail_' in ccorres_split_nothrow) apply (clarsimp simp: scheduleSwitchThreadFastfail_def) apply (rule ccorres_cond_seq2[THEN iffD1]) apply (rule_tac xf'=ret__int_' and val="from_bool (curThread = it)"
                      and R="\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s" and R'=UNIV
                      in ccorres_symb_exec_r_known_rv) apply (rule conseqPre, vcg, fastforce simp: rf_sr_ksCurThread rf_sr_ksIdleThread) apply ceqv apply clarsimp apply (rule ccorres_cond2'[where R=\<top>], fastforce) apply clarsimp apply (rule ccorres_return[where R'=UNIV], clarsimp, vcg) apply (rule_tac P="\<lambda>s. obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) curThread s
                                     \<and> curThread = ksCurThread s
                                     \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s"
                       and P'=UNIV in ccorres_from_vcg) apply clarsimp apply (rule conseqPre, vcg) apply (clarsimp simp: return_def cur_tcb'_def rf_sr_ksCurThread) apply (drule (1) obj_at_cslift_tcb)+ apply (clarsimp simp: typ_heap_simps ctcb_relation_def split: if_split) apply unat_arith apply clarsimp apply vcg apply ceqv 
           (* fastfail calculation complete *)
            apply (rename_tac fastfail fastfail') apply (rule ccorres_pre_curDomain) 
           (* rest of the calculation: fastfail \<and> \<not> highest *)
            apply (rule ccorres_rhs_assoc2) apply (rule_tac r'="\<lambda>hprio rv'. to_bool rv' = (fastfail \<and> \<not>hprio)" and xf'=ret__int_'
                    in ccorres_split_nothrow) apply (csymbr) apply (clarsimp simp: to_bool_def) apply (rule ccorres_Cond_rhs ; clarsimp) apply (rule ccorres_move_c_guard_tcb) apply (rule ccorres_add_return2) apply (ctac add: isHighestPrio_ccorres, clarsimp) apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (rule ccorres_return) apply (rule conseqPre, vcg) apply (clarsimp simp: to_bool_def) apply (rule wp_post_taut) apply (vcg exspec=isHighestPrio_modifies) apply (rule_tac P=\<top> and P'="{s. ret__int_' s = 0}" in ccorres_from_vcg) apply clarsimp apply (rule conseqPre, vcg) apply (fastforce simp: isHighestPrio_def' gets_def return_def get_def
                                       Nondet_Monad.bind_def
                                split: prod.split) apply ceqv apply (clarsimp simp: to_bool_def) 
             (* done with calculation of main acceptance criterion for candidate *)
              apply (rule ccorres_cond_seq) apply (rule ccorres_cond[where R=\<top>], blast) 
              (* candidate is not the best one, enqueue and choose new thread *)
               apply (rule ccorres_rhs_assoc)+ apply (ctac add: tcbSchedEnqueue_ccorres) apply clarsimp apply (ctac(no_simp) add: ccorres_setSchedulerAction) apply (clarsimp simp: cscheduler_action_relation_def) 
                  (* isolate haskell part before setting thread action *)
                   apply (simp add: scheduleChooseNewThread_def) apply (rule ccorres_lhs_assoc)+ apply (rule ccorres_split_nothrow_dc) apply (simp add: bind_assoc) apply (ctac add: scheduleChooseNewThread_ccorres) apply (ctac(no_simp) add: ccorres_setSchedulerAction) apply (wpsimp simp: cscheduler_action_relation_def)+ apply (vcg exspec=scheduleChooseNewThread_modifies) apply (wp add: setSchedulerAction_invs' setSchedulerAction_direct del: ssa_wp) apply (clarsimp | vcg exspec=tcbSchedEnqueue_modifies | wp wp_post_taut)+ 
             (* secondary check, when on equal prio and ct was running, prefer ct *)
              apply (rule ccorres_rhs_assoc) apply (rule_tac xf'=ret__int_' and val="from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)"
                      and R="\<lambda>s. curThread = ksCurThread s
                                 \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s
                                 \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s"
                      and R'=UNIV
                      in ccorres_symb_exec_r_known_rv) apply clarsimp apply (rule conseqPre, vcg) apply (clarsimp simp: cur_tcb'_def rf_sr_ksCurThread) apply (drule (1) obj_at_cslift_tcb)+ apply (clarsimp simp: typ_heap_simps ctcb_relation_def split: if_split) apply (solves \<open>unat_arith, rule iffI; simp\<close>) apply ceqv apply clarsimp apply (rule ccorres_cond_seq) apply (rule ccorres_cond[where R=\<top>], blast) 
               (* candidate does not beat running ct, append and choose new thread *)
                apply (rule ccorres_rhs_assoc)+ apply (ctac add: tcbSchedAppend_ccorres) apply clarsimp apply (ctac(no_simp) add: ccorres_setSchedulerAction) apply (clarsimp simp: cscheduler_action_relation_def) 
                   (* isolate haskell part before setting thread action *)
                    apply (simp add: scheduleChooseNewThread_def) apply (rule ccorres_lhs_assoc)+ apply (rule ccorres_split_nothrow_dc) apply (simp add: bind_assoc) apply (ctac add: scheduleChooseNewThread_ccorres) apply (ctac(no_simp) add: ccorres_setSchedulerAction) apply (wpsimp simp: cscheduler_action_relation_def)+ apply (vcg exspec=scheduleChooseNewThread_modifies) apply (wp add: setSchedulerAction_invs' setSchedulerAction_direct del: ssa_wp) apply (clarsimp | vcg exspec=tcbSchedAppend_modifies | wp wp_post_taut)+ 
              (* candidate is best, switch to it *)
               apply (ctac add: switchToThread_ccorres) apply clarsimp apply (ctac(no_simp) add: ccorres_setSchedulerAction) apply (clarsimp simp: cscheduler_action_relation_def) apply (wpsimp wp: wp_post_taut) apply (vcg exspec=switchToThread_modifies) apply clarsimp apply vcg apply clarsimp apply (strengthen invs'_invs_no_cicd') apply (wp | wp (once) hoare_drop_imp)+ apply clarsimp apply (vcg exspec=isHighestPrio_modifies) apply clarsimp apply (wp (once) hoare_drop_imps) apply wp apply (strengthen strenghten_False_imp[where P="a = ResumeCurrentThread" for a]) apply (clarsimp simp: conj_ac invs_queues invs_valid_objs' cong: conj_cong) apply wp apply (clarsimp, vcg exspec=tcbSchedEnqueue_modifies) apply (clarsimp, vcg exspec=tcbSchedEnqueue_modifies) apply clarsimp apply (strengthen ko_at'_obj_at'_field) apply (clarsimp cong: imp_cong simp: ko_at'_obj_at'_field) apply wp apply clarsimp 
      (* when runnable tcbSchedEnqueue curThread *)
       apply (rule_tac Q="\<lambda>rv s. invs' s \<and> ksCurThread s = curThread
                                \<and> ksSchedulerAction s = SwitchToThread candidate" in hoare_post_imp) apply (clarsimp simp: invs'_bitmapQ_no_L1_orphans invs_ksCurDomain_maxDomain') apply (fastforce dest: invs_sch_act_wf') apply wpsimp+ apply (vcg exspec=tcbSchedEnqueue_modifies) apply wp apply vcg apply (clarsimp simp: tcb_at_invs' rf_sr_ksCurThread if_apply_def2 invs_queues invs_valid_objs') apply (frule invs_sch_act_wf') apply (frule tcb_at_invs') apply (rule conjI) apply (clarsimp dest!: rf_sr_cscheduler_relation simp: cscheduler_action_relation_def) apply (rule conjI; clarsimp) apply (frule (1) obj_at_cslift_tcb) apply (clarsimp simp: cscheduler_action_relation_def typ_heap_simps
                  split: scheduler_action.splits) apply (frule (1) obj_at_cslift_tcb) apply (clarsimp dest!: rf_sr_cscheduler_relation invs_sch_act_wf'
                  simp: cscheduler_action_relation_def) apply (intro conjI impI allI; clarsimp simp: typ_heap_simps ctcb_relation_def to_bool_def) apply (fastforce simp: tcb_at_not_NULL tcb_at_1 dest: pred_tcb_at')+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] ThreadDecls_H.schedule (Call schedule_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] ThreadDecls_H.schedule (Call schedule_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] ThreadDecls_H.schedule (Call schedule_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] ThreadDecls_H.schedule (Call schedule_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] ThreadDecls_H.schedule (Call schedule_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' UNIV [] ThreadDecls_H.schedule (Call schedule_'proc) proof (prove)
goal (2 subgoals):
 1. ccorres dc xfdc ?Q623 ?Q'623 [SKIP] (do curThread <- getCurThread;
action <- getSchedulerAction;
case action of ResumeCurrentThread \<Rightarrow> return () | ChooseNewThread \<Rightarrow> do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od | SwitchToThread candidate \<Rightarrow> do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q623 s \<and> s' \<in> ?Q'623 proof (prove)
goal (2 subgoals):
 1. \<And>curThread. ccorres dc xfdc (?P629 curThread) (?P'629 curThread) [SKIP] (do action <- getSchedulerAction;
case action of ResumeCurrentThread \<Rightarrow> return () | ChooseNewThread \<Rightarrow> do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od | SwitchToThread candidate \<Rightarrow> do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> ?P629 rv s) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> ?P'629 rv} proof (prove)
goal (2 subgoals):
 1. \<And>curThread action. ccorres dc xfdc (?P631 curThread action) (?P'631 curThread action) [SKIP] (case action of ResumeCurrentThread \<Rightarrow> return () | ChooseNewThread \<Rightarrow> do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od | SwitchToThread candidate \<Rightarrow> do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> ?P631 rv rva s)) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> ?P'631 rv rva}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread action. action = ResumeCurrentThread \<Longrightarrow> ccorres dc xfdc (?R643 curThread action) (?R''646 curThread action) [SKIP] (return ()) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> ?R643 rv rva s) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> ?R''646 rv rva} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread action. action = ResumeCurrentThread \<Longrightarrow> ccorres dc xfdc (?R643 curThread action) (?R''646 curThread action) [SKIP] (return ()) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> ?R643 rv rva s) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> ?R''646 rv rva} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread action. action = ResumeCurrentThread \<Longrightarrow> ccorres dc xfdc (?R643 curThread action) (?R'651 curThread action) [SKIP] (return ()) (SKIP;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> ?R643 rv rva s) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> ?R'651 rv rva \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread. ccorres dc xfdc (?R643 curThread ResumeCurrentThread) (?R'651 curThread ResumeCurrentThread) [SKIP] (return ()) (\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> ?R643 rv rva s) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> ?R'651 rv rva \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ksSchedulerAction :== NULL {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> {s. ksSchedulerAction_' (globals s) = NULL \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ksSchedulerAction :== NULL {s. (\<sigma>, s) \<in> rf_sr}
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R''647 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R''647 rv rva} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R'686 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R'686 rv rva \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?R'686 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (lvar_nondet_init was_runnable_' was_runnable_'_update;;
(\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL))))
 2. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> ?R'686 rv rva \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?G'696 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))
 2. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> ?G'696 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> ccorres dc xfdc (?R644 curThread action) (?G'696 curThread action) [SKIP] (do curRunnable <- isRunnable curThread;
when curRunnable $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))
 2. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> ?R644 rv rva s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> ?G'696 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (5 subgoals):
 1. \<And>curThread action rv runnable. \<lbrakk>action = ChooseNewThread; rv = to_bool runnable\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q707 curThread action rv) (?Q'707 curThread action rv runnable) [SKIP] (do when rv $ tcbSchedEnqueue curThread;
scheduleChooseNewThread
od) (IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>?Q707 curThread action\<rbrace>
 3. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'707 curThread action rv (ret__unsigned_long_' s)}
 4. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (5 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?Q707 curThread ChooseNewThread (runnable \<noteq> 0)) (?Q'707 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (do y <- when (runnable \<noteq> 0) (tcbSchedEnqueue curThread);
scheduleChooseNewThread
od) (IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>?Q707 curThread action\<rbrace>
 3. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'707 curThread action rv (ret__unsigned_long_' s)}
 4. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?P1055 curThread ChooseNewThread (runnable \<noteq> 0)) (?P'1051 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (when (runnable \<noteq> 0) (tcbSchedEnqueue curThread)) (IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI)
 2. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 4. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. ?P1055 curThread action a and ?R1054 curThread action a\<rbrace>
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?P'1051 curThread action rv (ret__unsigned_long_' s) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 7. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?P1055 curThread ChooseNewThread (runnable \<noteq> 0)) (?P'1051 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (when (runnable \<noteq> 0) (tcbSchedEnqueue curThread)) (IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI)
 2. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 4. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. ?P1055 curThread action a and ?R1054 curThread action a\<rbrace>
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?P'1051 curThread action rv (ret__unsigned_long_' s) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 7. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?P1055 curThread ChooseNewThread (runnable \<noteq> 0)) (?P'1051 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (if runnable \<noteq> 0 then tcbSchedEnqueue curThread else return ()) (IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI)
 2. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 4. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. ?P1055 curThread action a and ?R1054 curThread action a\<rbrace>
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?P'1051 curThread action rv (ret__unsigned_long_' s) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 7. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (9 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?Pt1068 curThread ChooseNewThread (runnable \<noteq> 0)) (?Rt1064 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (tcbSchedEnqueue curThread) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread))
 2. \<And>curThread runnable. ccorres dc xfdc (?Pf1067 curThread ChooseNewThread (runnable \<noteq> 0)) (?Rf1063 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (return ()) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false)
 3. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 5. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> ?Pt1068 curThread action a s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1067 curThread action a s) and ?R1054 curThread action a\<rbrace>
 7. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> (?Rt1064 curThread action rv (ret__unsigned_long_' s) \<inter> \<lbrace>rv\<rbrace> \<union> ?Rf1063 curThread action rv (ret__unsigned_long_' s) \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 8. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (9 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?Pt1068 curThread ChooseNewThread (runnable \<noteq> 0)) (?G'1077 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (tcbSchedEnqueue curThread) (CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread))
 2. \<And>curThread runnable. ccorres dc xfdc (?Pf1067 curThread ChooseNewThread (runnable \<noteq> 0)) (?Rf1063 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (return ()) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false)
 3. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 5. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> ?Pt1068 curThread action a s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1067 curThread action a s) and ?R1054 curThread action a\<rbrace>
 7. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({sa. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) sa \<in> ?G'1077 curThread action rv (ret__unsigned_long_' s)} \<inter> \<lbrace>rv\<rbrace> \<union> ?Rf1063 curThread action rv (ret__unsigned_long_' s) \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 8. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread runnable. ccorres dc xfdc (?Pf1067 curThread ChooseNewThread (runnable \<noteq> 0)) (?Rf1063 curThread ChooseNewThread (runnable \<noteq> 0) runnable) [SKIP] (return ()) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false)
 2. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 4. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1067 curThread action a s) and ?R1054 curThread action a\<rbrace>
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> ?Rf1063 curThread action rv (ret__unsigned_long_' s) \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 7. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread runnable. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 4. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 7. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma>. {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> rf_sr}
 2. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 4. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 7. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?Q'1049 curThread runnable y rv') [SKIP] scheduleChooseNewThread (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 3. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1049 curThread runnable y (xfdc s)}
 4. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 6. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?R'1126 curThread runnable y rv') [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 3. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?R'1126 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 6. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread runnable y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1049 curThread runnable y) (?R'1126 curThread runnable y rv') [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 3. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?R'1126 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 6. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread runnable rv'. ccorres dc xfdc (?Q1049 curThread runnable ()) (?R'1126 curThread runnable () rv') [SKIP] (do domainTime <- getDomainTime;
y <- when (domainTime = 0) nextDomain;
y <- chooseThread;
setSchedulerAction ResumeCurrentThread
od) (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 3. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?R'1126 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 6. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread runnable rv'. ccorres dc xfdc (?Q1049 curThread runnable ()) (?R'1126 curThread runnable () rv') [SKIP] (do a <- do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od;
setSchedulerAction ResumeCurrentThread
od) (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1049 curThread runnable\<rbrace>
 3. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?R'1126 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 5. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 6. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (10 subgoals):
 1. \<And>curThread runnable rv'. ccorres dc xfdc (?P1151 curThread runnable ()) (?P'1146 curThread runnable () rv') [SKIP] (do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od) (CALL scheduleChooseNewThread_'proc())
 2. \<And>curThread runnable rv' rv rv'a. dc rv rv'a \<Longrightarrow> ccorres dc xfdc (?Q1144 curThread runnable rv' rv) (?Q'1144 curThread runnable rv' rv rv'a) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable rv'. \<lbrace>?R1149 curThread runnable ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q1144 curThread runnable rv'\<rbrace>
 4. \<And>curThread runnable rv'. \<Gamma>\<turnstile>\<^bsub>/?F1144 curThread runnable rv'\<^esub> (?R'1145 curThread runnable () rv') CALL scheduleChooseNewThread_'proc() {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1144 curThread runnable rv' rv (xfdc s)}
 5. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a. ?P1151 curThread runnable a and ?R1149 curThread runnable a\<rbrace>
 6. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?P'1146 curThread runnable y (xfdc s) \<inter> ?R'1145 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 8. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 9. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (10 subgoals):
 1. \<And>curThread runnable rv'. ccorres dc xfdc (?P1151 curThread runnable ()) (?P'1146 curThread runnable () rv') [SKIP] (do x <- getDomainTime;
y <- when (x = 0) nextDomain;
chooseThread
od) (CALL scheduleChooseNewThread_'proc())
 2. \<And>curThread runnable rv' rv rv'a. dc rv rv'a \<Longrightarrow> ccorres dc xfdc (?Q1144 curThread runnable rv' rv) (?Q'1144 curThread runnable rv' rv rv'a) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread runnable rv'. \<lbrace>?R1149 curThread runnable ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q1144 curThread runnable rv'\<rbrace>
 4. \<And>curThread runnable rv'. \<Gamma>\<turnstile>\<^bsub>/?F1144 curThread runnable rv'\<^esub> (?R'1145 curThread runnable () rv') CALL scheduleChooseNewThread_'proc() {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1144 curThread runnable rv' rv (xfdc s)}
 5. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a. ?P1151 curThread runnable a and ?R1149 curThread runnable a\<rbrace>
 6. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?P'1146 curThread runnable y (xfdc s) \<inter> ?R'1145 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 8. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 9. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (9 subgoals):
 1. \<And>curThread runnable rv' rv rv'a. dc rv rv'a \<Longrightarrow> ccorres dc xfdc (?Q1144 curThread runnable rv' rv) (?Q'1144 curThread runnable rv' rv rv'a) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread runnable rv'. \<lbrace>?R1149 curThread runnable ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q1144 curThread runnable rv'\<rbrace>
 3. \<And>curThread runnable rv'. \<Gamma>\<turnstile>\<^bsub>/?F1144 curThread runnable rv'\<^esub> (?R'1145 curThread runnable () rv') CALL scheduleChooseNewThread_'proc() {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1144 curThread runnable rv' rv (xfdc s)}
 4. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and ?R1149 curThread runnable a\<rbrace>
 5. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'1145 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 7. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 8. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (9 subgoals):
 1. \<And>curThread runnable rv' rv rv'a. dc rv rv'a \<Longrightarrow> cscheduler_action_relation ResumeCurrentThread NULL
 2. \<And>curThread runnable rv'. \<lbrace>?R1149 curThread runnable ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>curThread runnable rv'. \<Gamma>\<turnstile>\<^bsub>/?F1144 curThread runnable rv'\<^esub> (?R'1145 curThread runnable () rv') CALL scheduleChooseNewThread_'proc() {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread runnable. \<lbrace>?R1054 curThread ChooseNewThread (runnable \<noteq> 0)\<rbrace> when (runnable \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and ?R1149 curThread runnable a\<rbrace>
 5. \<And>curThread runnable. \<Gamma>\<turnstile>\<^bsub>/?F1049 curThread runnable\<^esub> (?R'1050 curThread ChooseNewThread (runnable \<noteq> 0) runnable) IF runnable \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'1145 curThread runnable y (xfdc s) \<inter> \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<lbrace>?R707 curThread action\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1054 curThread action a\<rbrace>
 7. \<And>curThread action. action = ChooseNewThread \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'707 curThread action) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1050 curThread action rv (ret__unsigned_long_' s)}
 8. \<And>curThread action x3. action = SwitchToThread x3 \<Longrightarrow> ccorres dc xfdc (?R645 curThread action x3) (?R''648 curThread action x3) [SKIP] (do wasRunnable <- isRunnable curThread;
when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and ?R707 rv rva) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'707 rv rva} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread x3. ccorres dc xfdc (?R645 curThread (SwitchToThread x3) x3) (?R''648 curThread (SwitchToThread x3) x3) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread x3. ccorres dc xfdc (?R645 curThread (SwitchToThread x3) x3) (?R''648 curThread (SwitchToThread x3) x3) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority x3;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend x3;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread x3;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. ccorres dc xfdc (?R645 curThread (SwitchToThread candidate) candidate) (?R''648 curThread (SwitchToThread candidate) candidate) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ?R645 rv rva x s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> ?R''648 rv rva x}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. ccorres dc xfdc (?P'1305 curThread (SwitchToThread candidate) candidate) (?Q1304 curThread (SwitchToThread candidate) candidate) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction \<noteq> NULL THEN
  lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and ?P'1305 rv rva x) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> ?Q1304 rv rva x}}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. ccorres dc xfdc (?P'1305 curThread (SwitchToThread candidate) candidate) (?R'1307 curThread (SwitchToThread candidate) candidate) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (lvar_nondet_init was_runnable_' was_runnable_'_update;;
\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and ?P'1305 rv rva x) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> ?R'1307 rv rva x \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. ccorres dc xfdc (?P'1305 curThread (SwitchToThread candidate) candidate) (?R'1307 curThread (SwitchToThread candidate) candidate) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (lvar_nondet_init was_runnable_' was_runnable_'_update;;
(\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL))))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and ?P'1305 rv rva x) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> ?R'1307 rv rva x \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. ccorres dc xfdc (?P'1305 curThread (SwitchToThread candidate) candidate) (?G'1319 curThread (SwitchToThread candidate) candidate) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and ?P'1305 rv rva x) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> ?G'1319 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. ccorres dc xfdc (?P'1305 curThread (SwitchToThread candidate) candidate) (?G'1319 curThread (SwitchToThread candidate) candidate) [SKIP] (do wasRunnable <- isRunnable curThread;
y <- when wasRunnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if wasRunnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and ?P'1305 rv rva x) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> ?G'1319 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread candidate runnable runnable'. runnable = to_bool runnable' \<Longrightarrow> ccorres dc xfdc (?Q1330 curThread candidate runnable) (?Q'1330 curThread candidate runnable runnable') [SKIP] (do y <- when runnable (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>?Q1330 curThread candidate\<rbrace>
 3. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'1330 curThread candidate rv (ret__unsigned_long_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?Q1330 curThread candidate (runnable' \<noteq> 0)) (?Q'1330 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (do y <- when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread);
idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI;;
(IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>?Q1330 curThread candidate\<rbrace>
 3. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'1330 curThread candidate rv (ret__unsigned_long_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?P1683 curThread candidate (runnable' \<noteq> 0)) (?P'1679 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread)) (IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI)
 2. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. ?P1683 curThread candidate a and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?P'1679 curThread candidate rv (ret__unsigned_long_' s) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?P1683 curThread candidate (runnable' \<noteq> 0)) (?P'1679 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread)) (IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI)
 2. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. ?P1683 curThread candidate a and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?P'1679 curThread candidate rv (ret__unsigned_long_' s) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?P1683 curThread candidate (runnable' \<noteq> 0)) (?P'1679 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (if runnable' \<noteq> 0 then tcbSchedEnqueue curThread else return ()) (IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI)
 2. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. ?P1683 curThread candidate a and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?P'1679 curThread candidate rv (ret__unsigned_long_' s) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?Pt1696 curThread candidate (runnable' \<noteq> 0)) (?Rt1692 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (tcbSchedEnqueue curThread) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread))
 2. \<And>curThread candidate runnable'. ccorres dc xfdc (?Pf1695 curThread candidate (runnable' \<noteq> 0)) (?Rf1691 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (return ()) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false)
 3. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> ?Pt1696 curThread candidate a s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1695 curThread candidate a s) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> (?Rt1692 curThread candidate rv (ret__unsigned_long_' s) \<inter> \<lbrace>rv\<rbrace> \<union> ?Rf1691 curThread candidate rv (ret__unsigned_long_' s) \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?Pt1696 curThread candidate (runnable' \<noteq> 0)) (?G'1705 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (tcbSchedEnqueue curThread) (CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread))
 2. \<And>curThread candidate runnable'. ccorres dc xfdc (?Pf1695 curThread candidate (runnable' \<noteq> 0)) (?Rf1691 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (return ()) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false)
 3. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> ?Pt1696 curThread candidate a s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1695 curThread candidate a s) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({sa. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) sa \<in> ?G'1705 curThread candidate rv (ret__unsigned_long_' s)} \<inter> \<lbrace>rv\<rbrace> \<union> ?Rf1691 curThread candidate rv (ret__unsigned_long_' s) \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable'. ccorres dc xfdc (?Pf1695 curThread candidate (runnable' \<noteq> 0)) (?Rf1691 curThread candidate (runnable' \<noteq> 0) runnable') [SKIP] (return ()) (\<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false)
 2. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> ?Pf1695 curThread candidate a s) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> ?Rf1691 curThread candidate rv (ret__unsigned_long_' s) \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable'. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma>. {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s) \<in> rf_sr}
 2. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?Q'1677 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (IF \<acute>ksSchedulerAction = tcb_Ptr 1 THEN
  CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1677 curThread candidate runnable' y (xfdc s)}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable' y rv'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?R'1754 curThread candidate runnable' y rv') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if \<acute>was_runnable \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?R'1754 curThread candidate runnable' y (xfdc s) \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable' y rv' rv'a. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?G'1756 curThread candidate runnable' y rv' rv'a) [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if rv'a \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?G'1756 curThread candidate runnable' y (xfdc s) (was_runnable_' sa)} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable' y rv' was_runnable'. dc y rv' \<Longrightarrow> ccorres dc xfdc (?Q1677 curThread candidate runnable' y) (?G'1756 curThread candidate runnable' y rv' was_runnable') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if was_runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?G'1756 curThread candidate runnable' y (xfdc s) (was_runnable_' sa)} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable' rv'. ccorres dc xfdc (?Q1677 curThread candidate runnable' ()) (?G'2180 curThread candidate runnable' () rv' runnable') [SKIP] (do idleThread <- getIdleThread;
targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread idleThread curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?G'2180 curThread candidate runnable' y (xfdc s) (was_runnable_' sa) \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable' rv' it. ccorres dc xfdc (?Q2199 curThread candidate runnable' rv' it) (?Q'2205 curThread candidate runnable' () runnable' rv' it) [SKIP] (do targetPrio <- threadGet tcbPriority candidate;
curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>?Q2199 curThread candidate runnable' rv'\<rbrace>
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> ?Q'2205 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio. ccorres dc xfdc (?P2208 curThread candidate runnable' rv' it targetPrio) (?P'2208 curThread candidate runnable' rv' it targetPrio) [SKIP] (do curPrio <- threadGet tcbPriority curThread;
fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> ?P2208 curThread candidate runnable' rv' it (tcbPriority tcb) s\<rbrace>
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?P'2210 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2210 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb. ?P'2208 curThread candidate runnable' rv' it (tcbPriority tcb) proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2212 curThread candidate runnable' rv' it targetPrio curPrio) (?P'2212 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ?P2212 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s)\<rbrace>
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2214 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2214 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2212 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2212 curThread candidate runnable' rv' it targetPrio curPrio) (?P'2212 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>candidate :== \<acute>ksSchedulerAction;;
(\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))))))
 2. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ?P2212 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s)\<rbrace>
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2214 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2214 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2212 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio s. \<Gamma>\<turnstile> (UNIV \<inter> {s'. ksSchedulerAction s = SwitchToThread candidate \<and> (s, s') \<in> rf_sr}) \<acute>candidate :== \<acute>ksSchedulerAction ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>candidate = tcb_ptr_to_ctcb_ptr candidate\<rbrace>)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> candidate_' rv'a t t' (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))))) (?y'2228 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?y'2228 curThread candidate runnable' rv' it targetPrio curPrio (tcb_ptr_to_ctcb_ptr candidate))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>candidate s x. \<lbrakk>ksSchedulerAction s = SwitchToThread candidate; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> ksSchedulerAction_' (globals x) = tcb_ptr_to_ctcb_ptr candidate
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> candidate_' rv'a t t' (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))))) (?y'2228 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?y'2228 curThread candidate runnable' rv' it targetPrio curPrio (tcb_ptr_to_ctcb_ptr candidate))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (9 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> candidate_' rv'a t t' (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c candidate_' s} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(\<acute>candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(\<acute>candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)))))) (?y'2228 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?y'2228 curThread candidate runnable' rv' it targetPrio curPrio (tcb_ptr_to_ctcb_ptr candidate))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 5. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 6. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 8. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres dc xfdc (?P2228 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2228 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (do fastfail <- scheduleSwitchThreadFastfail curThread it curPrio targetPrio;
curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int;;
(\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?Q2228 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2765 curThread candidate runnable' rv' it targetPrio curPrio) (?P'2765 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (scheduleSwitchThreadFastfail curThread it curPrio targetPrio) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2765 curThread candidate runnable' rv' it targetPrio curPrio \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2765 curThread candidate runnable' rv' it targetPrio curPrio) (?P'2765 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (if curThread \<noteq> it then return (targetPrio < curPrio) else return True) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2765 curThread candidate runnable' rv' it targetPrio curPrio \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2765 curThread candidate runnable' rv' it targetPrio curPrio) (?P'2765 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (if curThread \<noteq> it then return (targetPrio < curPrio) else return True) (\<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2765 curThread candidate runnable' rv' it targetPrio curPrio \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio s. \<Gamma>\<turnstile> (UNIV \<inter> {s'. (it = ksIdleThread s \<and> curThread = ksCurThread s) \<and> (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (curThread = it)\<rbrace>)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  SKIP;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
FI) (?y'2777 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2777 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2777 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (if curThread \<noteq> it then return (targetPrio < curPrio) else return True) (?y'2777 curThread candidate runnable' rv' it targetPrio curPrio (from_bool (curThread = it)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> ?Q2777 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2777 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  SKIP;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
FI) (?y'2777 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2777 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2777 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (if curThread \<noteq> it then return (targetPrio < curPrio) else return True) (?y'2777 curThread candidate runnable' rv' it targetPrio curPrio (from_bool (curThread = it)))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> ?Q2777 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2777 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2777 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2777 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (if curThread \<noteq> it then return (targetPrio < curPrio) else return True) (IF from_bool (curThread = it) \<noteq> 0 THEN
  SKIP;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> ?Q2777 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2777 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?P2777 curThread candidate runnable' rv' it targetPrio curPrio) (?Q2777 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (if curThread \<noteq> it then return (targetPrio < curPrio) else return True) (IF curThread = it THEN
  SKIP;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> ?Q2777 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (?P2777 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?Pt2883 curThread candidate runnable' rv' it targetPrio curPrio) (?Rt2883 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (return True) (SKIP;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it)))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?Pf2883 curThread candidate runnable' rv' it targetPrio curPrio) (?Rf2883 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (return (targetPrio < curPrio)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> ?Rt2883 curThread candidate runnable' rv' it targetPrio curPrio) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> ?Rf2883 curThread candidate runnable' rv' it targetPrio curPrio)}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> ?Pt2883 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> ?Pf2883 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?Pt2883 curThread candidate runnable' rv' it targetPrio curPrio) (?Rt2883 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (return True) (\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it)))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?Pf2883 curThread candidate runnable' rv' it targetPrio curPrio) (?Rf2883 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (return (targetPrio < curPrio)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> ?Rt2883 curThread candidate runnable' rv' it targetPrio curPrio) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> ?Rf2883 curThread candidate runnable' rv' it targetPrio curPrio)}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> ?Pt2883 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> ?Pf2883 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. ccorres (\<lambda>rv rv'. rv = to_bool rv') fastfail_' (?Pf2883 curThread candidate runnable' rv' it targetPrio curPrio) (?Rf2883 curThread candidate runnable' rv' it targetPrio curPrio) [SKIP] (return (targetPrio < curPrio)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> ?Rf2883 curThread candidate runnable' rv' it targetPrio curPrio)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> ?Pf2883 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) curThread \<sigma> \<and> curThread = ksCurThread \<sigma> \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate \<sigma>) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<exists>(rv, \<sigma>')\<in>fst (return (targetPrio < curPrio) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> rv = to_bool (fastfail_' s)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate targetPrio curPrio \<sigma>. \<Gamma>\<turnstile> {s. obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) curThread \<sigma> \<and> curThread = ksCurThread \<sigma> \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate \<sigma> \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)));;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<exists>x\<in>fst (return (targetPrio < curPrio) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> rv = to_bool (fastfail_' s)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate targetPrio curPrio \<sigma>. {s. obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) curThread \<sigma> \<and> curThread = ksCurThread \<sigma> \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate \<sigma> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<and> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<and> (\<exists>(rv, \<sigma>')\<in>fst (return (targetPrio < curPrio) \<sigma>). (\<sigma>', fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0)) (s\<lparr>ret__int_' := if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0\<rparr>)) \<in> rf_sr \<and> rv = to_bool (SCAST(32 signed \<rightarrow> 32) (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>candidate targetPrio curPrio \<sigma> x. \<lbrakk>obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread \<sigma>) \<sigma>; obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<and> (targetPrio < curPrio) = to_bool (if h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>candidate targetPrio curPrio \<sigma> x. \<lbrakk>(\<sigma>, x) \<in> rf_sr; \<exists>ko ko'. ko_at' ko (ksCurThread \<sigma>) \<sigma> \<and> tcbPriority ko = curPrio \<and> cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko' \<and> ctcb_relation ko ko'; \<exists>ko ko'. ko_at' ko candidate \<sigma> \<and> tcbPriority ko = targetPrio \<and> cslift x (tcb_ptr_to_ctcb_ptr candidate) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<and> (targetPrio < curPrio) = to_bool (if h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>candidate \<sigma> x ko koa ko' ko'a. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; ko_at' koa candidate \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; cslift x (tcb_ptr_to_ctcb_ptr candidate) = Some ko'a; tcbFaultHandler ko = tcbFaultHandler_C ko'; tcbFaultHandler koa = tcbFaultHandler_C ko'a; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); cthread_state_relation (tcbState koa) (tcbState_C ko'a, tcbFault_C ko'a); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; tcbIPCBuffer koa = tcbIPCBuffer_C ko'a; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); carch_tcb_relation (tcbArch koa) (tcbArch_C ko'a); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); tcbQueued koa = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'a))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbDomain koa) = tcbDomain_C ko'a; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority koa) = tcbPriority_C ko'a; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP koa) = tcbMCP_C ko'a; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); tcbTimeSlice koa = unat (tcbTimeSlice_C ko'a); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; cfault_rel (tcbFault koa) (seL4_Fault_lift (tcbFault_C ko'a)) (lookup_fault_lift (tcbLookupFailure_C ko'a)); option_to_ptr (tcbBoundNotification koa) = tcbBoundNotification_C ko'a\<rbrakk> \<Longrightarrow> (tcbPriority_C ko'a < tcbPriority_C ko' \<longrightarrow> tcbPriority koa < tcbPriority ko) \<and> (\<not> tcbPriority_C ko'a < tcbPriority_C ko' \<longrightarrow> \<not> tcbPriority koa < tcbPriority ko)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>candidate \<sigma> x ko koa ko' ko'a n na nb nc nd ne nf ng nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny. \<lbrakk>nj < 2 ^ LENGTH(32); tcbTimeSlice ko = nj; nk < 2 ^ LENGTH(32); tcbTimeSlice koa = nk; cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; cfault_rel (tcbFault koa) (seL4_Fault_lift (tcbFault_C ko'a)) (lookup_fault_lift (tcbLookupFailure_C ko'a)); option_to_ptr (tcbBoundNotification koa) = tcbBoundNotification_C ko'a; (\<sigma>, x) \<in> rf_sr; ko_at' ko (ksCurThread \<sigma>) \<sigma>; ko_at' koa candidate \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'; cslift x (tcb_ptr_to_ctcb_ptr candidate) = Some ko'a; n < 2 ^ LENGTH(32); nl < 2 ^ LENGTH(32); nl = n; na < 2 ^ LENGTH(32); nm < 2 ^ LENGTH(32); nm = na; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); cthread_state_relation (tcbState koa) (tcbState_C ko'a, tcbFault_C ko'a); nb < 2 ^ LENGTH(32); nn < 2 ^ LENGTH(32); nn = nb; nc < 2 ^ LENGTH(32); no < 2 ^ LENGTH(32); no = nc; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); carch_tcb_relation (tcbArch koa) (tcbArch_C ko'a); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); tcbQueued koa = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'a))); nd < 2 ^ LENGTH(32); np < 2 ^ LENGTH(32); np = nd; ne < 2 ^ LENGTH(32); nq < 2 ^ LENGTH(32); nq = ne; nf < 2 ^ LENGTH(32); nr < 2 ^ LENGTH(32); nr = nf; ng < 2 ^ LENGTH(32); ns < 2 ^ LENGTH(32); ns = ng; nh < 2 ^ LENGTH(32); nt < 2 ^ LENGTH(32); nt = nh; ni < 2 ^ LENGTH(32); nu < 2 ^ LENGTH(32); nu = ni; nv < 2 ^ LENGTH(32); nw < 2 ^ LENGTH(32); nx < 2 ^ LENGTH(8); ny < 2 ^ LENGTH(8); unat (tcbTimeSlice_C ko') = nj; unat (tcbTimeSlice_C ko'a) = nk; unat (tcbFaultHandler_C ko') = n; unat (tcbFaultHandler ko) = nl; unat (tcbFaultHandler_C ko'a) = na; unat (tcbFaultHandler koa) = nm; unat (tcbIPCBuffer_C ko') = nb; unat (tcbIPCBuffer ko) = nn; unat (tcbIPCBuffer_C ko'a) = nc; unat (tcbIPCBuffer koa) = no; unat (tcbDomain_C ko') = nd; unat (UCAST(8 \<rightarrow> 32) (tcbDomain ko)) = np; unat (tcbDomain_C ko'a) = ne; unat (UCAST(8 \<rightarrow> 32) (tcbDomain koa)) = nq; unat (tcbPriority_C ko') = nf; unat (UCAST(8 \<rightarrow> 32) (tcbPriority ko)) = nr; unat (tcbPriority_C ko'a) = ng; unat (UCAST(8 \<rightarrow> 32) (tcbPriority koa)) = ns; unat (tcbMCP_C ko') = nh; unat (UCAST(8 \<rightarrow> 32) (tcbMCP ko)) = nt; unat (tcbMCP_C ko'a) = ni; unat (UCAST(8 \<rightarrow> 32) (tcbMCP koa)) = nu; unat (tcbPriority_C ko'a) = nv; unat (tcbPriority_C ko') = nw; unat (tcbPriority koa) = nx; unat (tcbPriority ko) = ny\<rbrakk> \<Longrightarrow> (nv < nw \<longrightarrow> nx < ny) \<and> (\<not> nv < nw \<longrightarrow> \<not> nx < ny)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2777 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2777 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) {s. \<forall>rv. ret__int_' s = from_bool (curThread = it) \<longrightarrow> s \<in> {s. (s \<in> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV) \<and> (s \<notin> \<lbrace>curThread = it\<rbrace> \<longrightarrow> s \<in> UNIV)}}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> ?P'2777 curThread candidate runnable' rv' it targetPrio curPrio \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (11 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv'a t t'. ceqv \<Gamma> fastfail_' rv'a t t' (\<acute>ret__int :== (if \<acute>fastfail \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (?d'2765 curThread candidate runnable' rv' it targetPrio curPrio rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 6. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 7. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 8. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 9. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 10. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if rv'a \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv rv'a. rv = to_bool rv'a \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio rv) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv rv'a) [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if rv \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if rv'a \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail'. fastfail = to_bool fastfail' \<Longrightarrow> ccorres dc xfdc (?Q2765 curThread candidate runnable' rv' it targetPrio curPrio fastfail) (?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail') [SKIP] (do curDom <- curDomain;
highest <- isHighestPrio curDom targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>?Q2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> ?Q'2765 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P3676 curThread candidate runnable' rv' it targetPrio curPrio fastfail a rv) (?P'3674 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) [SKIP] (do highest <- isHighestPrio rv targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ?P3676 curThread candidate runnable' rv' it targetPrio curPrio a b rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> ?P'3674 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P3676 curThread candidate runnable' rv' it targetPrio curPrio fastfail a rv) (?P'3674 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) [SKIP] (do highest <- isHighestPrio rv targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ?P3676 curThread candidate runnable' rv' it targetPrio curPrio a b rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> ?P'3674 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> ccorres dc xfdc (?P3680 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv) (?P'3674 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) [SKIP] (do highest <- isHighestPrio rv targetPrio;
if fastfail \<and> \<not> highest then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od
od) (\<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ?P3680 curThread candidate runnable' rv' it targetPrio curPrio a rv b\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> ?P'3674 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail \<and> \<not> hprio)) ret__int_' (?P3689 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv) (?P'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) [SKIP] (isHighestPrio rv targetPrio) (\<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (?P3689 curThread candidate runnable' rv' it targetPrio curPrio a rv and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> ?P'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail \<and> \<not> hprio)) ret__int_' (?P3689 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv) (?G'3693 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) [SKIP] (isHighestPrio rv targetPrio) (IF (if fastfail' \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (?P3689 curThread candidate runnable' rv' it targetPrio curPrio a rv and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'3693 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail' \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?P3689 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) rv) (?G'3693 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv) [SKIP] (isHighestPrio rv targetPrio) (IF fastfail' \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (?P3689 curThread candidate runnable' rv' it targetPrio curPrio a rv and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'3693 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail' \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?Q3790 curThread candidate runnable' rv' it targetPrio curPrio True rv) (?S3792 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) [SKIP] (isHighestPrio rv targetPrio) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ?Q3790 curThread candidate runnable' rv' it targetPrio curPrio a rv b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> ?S3792 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail' \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?A3805 curThread candidate runnable' rv' it targetPrio curPrio True rv) (?C'3803 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) [SKIP] (isHighestPrio rv targetPrio) (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> (?A3805 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> ?C'3803 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail' \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?A3805 curThread candidate runnable' rv' it targetPrio curPrio True rv) (?C'3803 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) [SKIP] (isHighestPrio rv targetPrio >>= return) (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> (?A3805 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> ?C'3803 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv ret__unsigned_long. fastfail' \<noteq> 0 \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail' \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?Q3814 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv (to_bool ret__unsigned_long)) (?Q'3814 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv (to_bool ret__unsigned_long) ret__unsigned_long) [SKIP] (return (to_bool ret__unsigned_long)) (\<acute>ret__int :== (if ret__unsigned_long = 0 then 1 else 0))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<lbrace>?R3820 curThread candidate runnable' rv' it targetPrio curPrio True rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3814 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3815 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rva. rva = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'3814 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva (ret__unsigned_long_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and ?R3820 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> ?R'3815 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv ret__unsigned_long. fastfail' \<noteq> 0 \<Longrightarrow> ccorres (\<lambda>hprio rv'. to_bool rv' = (fastfail' \<noteq> 0 \<and> \<not> hprio)) ret__int_' (\<lambda>_. True) UNIV [SKIP] (return (to_bool ret__unsigned_long)) (\<acute>ret__int :== (if ret__unsigned_long = 0 then 1 else 0))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<lbrace>?R3820 curThread candidate runnable' rv' it targetPrio curPrio True rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3815 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and ?R3820 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> ?R'3815 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv ret__unsigned_long s. \<lbrakk>fastfail' \<noteq> 0; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned_long = 0 then 1 else 0) {s'. (s, s') \<in> rf_sr \<and> to_bool (ret__int_' s') = (fastfail' \<noteq> 0 \<and> \<not> to_bool ret__unsigned_long)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<lbrace>?R3820 curThread candidate runnable' rv' it targetPrio curPrio True rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3815 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and ?R3820 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> ?R'3815 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv ret__unsigned_long s. \<lbrakk>fastfail' \<noteq> 0; True\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, sa\<lparr>ret__int_' := if ret__unsigned_long = 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> to_bool (if ret__unsigned_long = 0 then 1 else 0) = (fastfail' \<noteq> 0 \<and> \<not> to_bool ret__unsigned_long)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<lbrace>?R3820 curThread candidate runnable' rv' it targetPrio curPrio True rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3815 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and ?R3820 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> ?R'3815 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (16 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<lbrace>?R3820 curThread candidate runnable' rv' it targetPrio curPrio True rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3815 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> UNIV}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and ?R3820 curThread candidate runnable' rv' it targetPrio curPrio a rv and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> ?R'3815 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. fastfail' \<noteq> 0 \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3815 curThread candidate runnable' rv' it targetPrio curPrio True fastfail' rv) \<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> UNIV}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> ?R'3815 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. ccorres (\<lambda>hprio rv'. to_bool rv' = (0 \<noteq> 0 \<and> \<not> hprio)) ret__int_' (?R3789 curThread candidate runnable' rv' it targetPrio curPrio False rv) (?T3791 curThread candidate runnable' rv' it targetPrio curPrio False 0 rv) [SKIP] (isHighestPrio rv targetPrio) SKIP
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> ?R3789 curThread candidate runnable' rv' it targetPrio curPrio a rv b)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T3791 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio rv. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} SKIP {s. \<exists>(rv, \<sigma>')\<in>fst (isHighestPrio rv targetPrio \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> to_bool (ret__int_' s) = (0 \<noteq> 0 \<and> \<not> rv)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>targetPrio rv \<sigma>. \<Gamma>\<turnstile> {s. ret__int_' s = 0 \<and> (\<sigma>, s) \<in> rf_sr} SKIP {s. \<exists>x\<in>fst (isHighestPrio rv targetPrio \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> \<not> to_bool (ret__int_' s)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>targetPrio rv \<sigma>. {s. ret__int_' s = 0 \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>x\<in>fst (isHighestPrio rv targetPrio \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> \<not> to_bool (ret__int_' s)}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a t t'. fastfail = to_bool fastfail' \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?d'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rv'a)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a. \<lbrakk>fastfail = to_bool fastfail'; to_bool rv'a = (fastfail \<and> \<not> rva)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva rv'a) [SKIP] (if fastfail \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF rv'a \<noteq> 0 THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if fastfail' \<noteq> 0 \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF fastfail' \<noteq> 0 \<and> \<not> rva THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if fastfail' \<noteq> 0 \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF fastfail' \<noteq> 0 \<and> \<not> rva THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q3682 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if fastfail' \<noteq> 0 \<and> \<not> rva then do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF fastfail' \<noteq> 0 \<and> \<not> rva THEN
  CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL
ELSE
  \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>?Q3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Q'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pt4082 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rt4077 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> ?Pt4082 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Rt4077 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pt4082 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rt4077 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> ?Pt4082 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Rt4077 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pt4082 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rt4077 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (do tcbSchedEnqueue candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate);;
(\<acute>ksSchedulerAction :== tcb_Ptr 1;;
(CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> ?Pt4082 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> ?Rt4077 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb xfdca. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb) (?Q'4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb xfdca) [SKIP] (K_bind (do setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) rvb) (\<acute>ksSchedulerAction :== tcb_Ptr 1;;
(CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>?Q4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()) (?Q'4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) [SKIP] (do y <- setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (\<acute>ksSchedulerAction :== tcb_Ptr 1;;
(CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>?Q4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4123 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (18 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> cscheduler_action_relation ChooseNewThread (tcb_Ptr 1)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb) (?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb) [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb) (?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb) [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb) (?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb) [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do domainTime <- getDomainTime;
y <- when (domainTime = 0) nextDomain;
y <- chooseThread;
setSchedulerAction ResumeCurrentThread
od) (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do a <- do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od;
setSchedulerAction ResumeCurrentThread
od) (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4166 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (20 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4212 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?P'4207 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od) (CALL scheduleChooseNewThread_'proc())
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb) (?Q'4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. ?P4212 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a and ?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?P'4207 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s) \<inter> ?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (20 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4212 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?P'4207 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do x <- getDomainTime;
y <- when (x = 0) nextDomain;
chooseThread
od) (CALL scheduleChooseNewThread_'proc())
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb) (?Q'4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. ?P4212 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a and ?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?P'4207 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s) \<inter> ?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (19 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb) (?Q'4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and ?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (19 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> cscheduler_action_relation ResumeCurrentThread NULL
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and ?R4210 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4205 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<^esub> (?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdc) CALL scheduleChooseNewThread_'proc() \<lbrace>True\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and (\<lambda>a. True)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'4206 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (16 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and (\<lambda>a. True)\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4171 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4129 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedEnqueue candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. (invs' and sch_act_wf ChooseNewThread and (\<lambda>s. ChooseNewThread = ResumeCurrentThread \<longrightarrow> obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s) and (\<lambda>s. ChooseNewThread = ResumeCurrentThread \<longrightarrow> ksCurThread s = ksIdleThread s \<or> tcb_in_cur_domain' (ksCurThread s) s)) a \<and> True \<and> True)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4124 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4167 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable' rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4129 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4124 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4080 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (\<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ?Pf4080 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?Rf4076 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a s. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. (curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s) \<and> (s, s') \<in> rf_sr}) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)\<rbrace>)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' targetPrio curPrio fastfail' rva rv'a s. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile> {s'. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s \<and> (s, s') \<in> rf_sr} \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)\<rbrace>)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' targetPrio curPrio fastfail' rva rv'a s. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> {s'. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. ((if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<and> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<and> (s, sa\<lparr>ret__int_' := if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then 1 else 0\<rparr>) \<in> rf_sr \<and> (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)) \<and> (\<not> (if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (s, sa\<lparr>ret__int_' := if runnable' \<noteq> 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if runnable' \<noteq> 0 then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio))}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>candidate runnable' targetPrio curPrio fastfail' rva rv'a s x. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s; obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s; (s, x) \<in> rf_sr; runnable' \<noteq> 0\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C'']))) = (curPrio = targetPrio)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>candidate runnable' targetPrio curPrio fastfail' rva rv'a s x. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); (s, x) \<in> rf_sr; runnable' \<noteq> 0; \<exists>ko ko'. ko_at' ko (ksCurThread s) s \<and> tcbPriority ko = curPrio \<and> cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko' \<and> ctcb_relation ko ko'; \<exists>ko ko'. ko_at' ko candidate s \<and> tcbPriority ko = targetPrio \<and> cslift x (tcb_ptr_to_ctcb_ptr candidate) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C'']))) = (curPrio = targetPrio)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>candidate runnable' fastfail' rva rv'a s x ko koa ko' ko'a. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); (s, x) \<in> rf_sr; runnable' \<noteq> 0; ko_at' ko (ksCurThread s) s; ko_at' koa candidate s; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; cslift x (tcb_ptr_to_ctcb_ptr candidate) = Some ko'a; tcbFaultHandler ko = tcbFaultHandler_C ko'; tcbFaultHandler koa = tcbFaultHandler_C ko'a; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); cthread_state_relation (tcbState koa) (tcbState_C ko'a, tcbFault_C ko'a); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; tcbIPCBuffer koa = tcbIPCBuffer_C ko'a; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); carch_tcb_relation (tcbArch koa) (tcbArch_C ko'a); tcbQueued ko = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'))); tcbQueued koa = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C ko'a))); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbDomain koa) = tcbDomain_C ko'a; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority koa) = tcbPriority_C ko'a; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP koa) = tcbMCP_C ko'a; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); tcbTimeSlice koa = unat (tcbTimeSlice_C ko'a); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; cfault_rel (tcbFault koa) (seL4_Fault_lift (tcbFault_C ko'a)) (lookup_fault_lift (tcbLookupFailure_C ko'a)); option_to_ptr (tcbBoundNotification koa) = tcbBoundNotification_C ko'a\<rbrakk> \<Longrightarrow> (tcbPriority_C ko'a = tcbPriority_C ko') = (tcbPriority ko = tcbPriority koa)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b t t'. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'b t t' (IF \<acute>ret__int \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>ksSchedulerAction :== tcb_Ptr 1;;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>ksSchedulerAction :== NULL) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rv'b)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (?y'4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a (from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio)))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 4. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<noteq> 0 THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 3. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF runnable' \<noteq> 0 \<and> curPrio = targetPrio THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc()
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate)
FI;;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 3. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P4359 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (if runnable' \<noteq> 0 \<and> curPrio = targetPrio then do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od else do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (IF runnable' \<noteq> 0 \<and> curPrio = targetPrio THEN
  CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)
ELSE
  CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL)
FI)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Q4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a}
 3. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> (?P4359 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pt4900 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rt4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Rt4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 4. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> ?Pt4900 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pt4900 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rt4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Rt4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 4. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> ?Pt4900 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pt4900 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rt4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do tcbSchedAppend candidate;
setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate);;
(\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. tcb_Ptr 1);;
(CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> ?Rt4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 4. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> ?Pt4900 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (16 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb xfdca. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb) (?Q'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb xfdca) [SKIP] (K_bind (do setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) rvb) (\<acute>ksSchedulerAction :== tcb_Ptr 1;;
(CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>?Q4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 6. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (16 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()) (?Q'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) [SKIP] (do y <- setSchedulerAction ChooseNewThread;
scheduleChooseNewThread
od) (\<acute>ksSchedulerAction :== tcb_Ptr 1;;
(CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>?Q4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 6. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (19 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> cscheduler_action_relation ChooseNewThread (tcb_Ptr 1)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb) (?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb) [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 9. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (18 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb) (?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb) [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 8. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (18 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb) (?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb xfdcb) [SKIP] scheduleChooseNewThread (CALL scheduleChooseNewThread_'proc();;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 8. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (18 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do domainTime <- getDomainTime;
y <- when (domainTime = 0) nextDomain;
y <- chooseThread;
setSchedulerAction ResumeCurrentThread
od) (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 8. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (18 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do a <- do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od;
setSchedulerAction ResumeCurrentThread
od) (CALL scheduleChooseNewThread_'proc();;
\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>?Q4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4986 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 8. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (21 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P5032 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?P'5027 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od) (CALL scheduleChooseNewThread_'proc())
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb) (?Q'5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. ?P5032 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a and ?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?P'5027 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s) \<inter> ?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
A total of 21 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (21 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?P5032 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()) (?P'5027 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) [SKIP] (do x <- getDomainTime;
y <- when (x = 0) nextDomain;
chooseThread
od) (CALL scheduleChooseNewThread_'proc())
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb) (?Q'5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. ?P5032 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a and ?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?P'5027 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s) \<inter> ?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
A total of 21 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (20 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb) (?Q'5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb rv'b) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>?Q5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and ?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 10. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (20 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc rvb rv'b. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb rv'b\<rbrakk> \<Longrightarrow> cscheduler_action_relation ResumeCurrentThread NULL
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca ()\<rbrace> do a <- do a <- getDomainTime;
when (a = 0) nextDomain
od;
chooseThread
od \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdcb\<^esub> (?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdcb) CALL scheduleChooseNewThread_'proc() {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and ?R5030 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 10. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (18 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F5025 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca xfdc\<^esub> (?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca () xfdc) CALL scheduleChooseNewThread_'proc() \<lbrace>True\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and (\<lambda>a. True)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> ?R'5026 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 8. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (17 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()\<rbrace> setSchedulerAction ChooseNewThread \<lbrace>\<lambda>a. (\<lambda>a. invs' a \<and> ksSchedulerAction a = ChooseNewThread) and (\<lambda>a. True)\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4991 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a a\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 7. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
A total of 17 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (16 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) \<acute>ksSchedulerAction :== tcb_Ptr 1 {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R4949 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> tcbSchedAppend candidate \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. (invs' and sch_act_wf ChooseNewThread and (\<lambda>s. ChooseNewThread = ResumeCurrentThread \<longrightarrow> obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s) and (\<lambda>s. ChooseNewThread = ResumeCurrentThread \<longrightarrow> ksCurThread s = ksIdleThread s \<or> tcb_in_cur_domain' (ksCurThread s) s)) a \<and> True \<and> True)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL tcbSchedAppend_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'4987 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'4946 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 6. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and ?R4949 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 10. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do a <- global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 3. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Pf4898 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva) (?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) [SKIP] (do a <- global.switchToThread candidate;
setSchedulerAction ResumeCurrentThread
od) (CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate);;
\<acute>globals :== ksSchedulerAction_'_update (\<lambda>_. NULL))
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> ?Rf4895 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 3. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> ?Pf4898 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb xfdca. \<lbrakk>(rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva); dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb) (?Q'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb xfdca) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5180 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> global.switchToThread candidate \<lbrace>?Q5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and ?R5180 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdca. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> ccorres dc xfdc (?Q5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a ()) (?Q'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a () xfdca) [SKIP] (setSchedulerAction ResumeCurrentThread) (\<acute>ksSchedulerAction :== NULL)
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5180 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> global.switchToThread candidate \<lbrace>?Q5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a rvb (xfdc s)}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and ?R5180 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (15 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a xfdc. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> cscheduler_action_relation ResumeCurrentThread NULL
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5180 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> global.switchToThread candidate \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 5. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and ?R5180 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 9. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 10. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (14 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<lbrace>?R5180 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva\<rbrace> global.switchToThread candidate \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 4. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and ?R5180 curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv a) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 8. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 9. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 10. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (13 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a) CALL switchToThread_'proc(tcb_ptr_to_ctcb_ptr candidate) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rvb. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> ?R'5177 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 3. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and (\<lambda>a. True)) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 7. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 8. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 9. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 10. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI {s. \<forall>rv. ret__int_' s = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace> \<union> {s. thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>runnable' \<noteq> 0 \<and> curPrio = targetPrio\<rbrace>}
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and (\<lambda>a. True)) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (12 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a. (rv'a \<noteq> 0) = (fastfail' \<noteq> 0 \<and> \<not> rva) \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft4355 curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv rva rv'a\<^esub> (?P'4357 curThread candidate runnable' rv' it targetPrio curPrio (fastfail' \<noteq> 0) fastfail' rv rva rv'a) \<acute>ret__int :== (if runnable' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI \<lbrace>\<acute>ret__int = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio\<rbrace>
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and (\<lambda>a. True)) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rva. to_bool (ret__int_' s) = (fastfail \<and> \<not> rva) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rva\<rbrace> \<union> ?P'4357 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv rva (ret__int_' s) \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rva\<rbrace>}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 6. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 7. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 8. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 9. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 10. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (11 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio fastfail rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. fastfail \<and> \<not> a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (fastfail \<and> \<not> a) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> (Invariants_H.valid_queues and tcb_at' candidate and valid_objs' and (invs' and st_tcb_at' runnable' candidate and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate))) s) and (\<lambda>s. \<not> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> (all_invs_but_ct_idle_or_in_cur_domain' and tcb_at' candidate and (\<lambda>a. True)) s) and (\<lambda>s. curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)) s)\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rv. to_bool (ret__int_' s) = (fastfail \<and> \<not> rv) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rv\<rbrace> \<union> {s. ((if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio) \<and> (\<not> (if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if runnable' \<noteq> 0 then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio)} \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rv\<rbrace>}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 6. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 7. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 8. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 9. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 10. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (11 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail' rv. \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio (to_bool fastfail') rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>a b. (to_bool fastfail' \<and> \<not> a \<longrightarrow> Invariants_H.valid_queues b \<and> tcb_at' candidate b \<and> valid_objs' b \<and> invs' b \<and> st_tcb_at' runnable' candidate b \<and> (ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> ksCurThread b \<noteq> candidate)) \<and> ((to_bool fastfail' \<longrightarrow> a) \<longrightarrow> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues b \<and> tcb_at' candidate b \<and> valid_objs' b \<and> invs' b \<and> st_tcb_at' runnable' candidate b \<and> (ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> ksCurThread b \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> all_invs_but_ct_idle_or_in_cur_domain' b \<and> tcb_at' candidate b) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> all_invs_but_ct_idle_or_in_cur_domain' b \<and> tcb_at' candidate b) \<and> curThread = ksCurThread b \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread b) b \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate b)\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rv. to_bool (ret__int_' s) = (fastfail \<and> \<not> rv) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rv\<rbrace> \<union> {s. ((if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio) \<and> (\<not> (if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if runnable' \<noteq> 0 then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio)} \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rv\<rbrace>}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 6. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 7. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 8. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 9. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 10. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (11 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio fastfail' rv. \<lbrace>?R3687 curThread candidate runnable'a rv' it targetPrio curPrio (to_bool fastfail') rv\<rbrace> isHighestPrio rv targetPrio \<lbrace>\<lambda>r s. (to_bool fastfail' \<and> \<not> r \<longrightarrow> Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate)) \<and> ((to_bool fastfail' \<longrightarrow> r) \<longrightarrow> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s)\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rv. to_bool (ret__int_' s) = (fastfail \<and> \<not> rv) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rv\<rbrace> \<union> {s. ((if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio) \<and> (\<not> (if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if runnable' \<noteq> 0 then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio)} \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rv\<rbrace>}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and ?R3687 curThread candidate runnable' rv' it targetPrio curPrio a rv) b\<rbrace>
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 5. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 6. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 7. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 8. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 9. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 10. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv. fastfail = to_bool fastfail' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio fastfail fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI {s. \<forall>rv. to_bool (ret__int_' s) = (fastfail \<and> \<not> rv) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr candidate) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr candidate\<rbrace>} \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>fastfail \<and> \<not> rv\<rbrace> \<union> {s. ((if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio) \<and> (\<not> (if runnable' \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if runnable' \<noteq> 0 then 1 else 0) = from_bool (runnable' \<noteq> 0 \<and> curPrio = targetPrio) \<longrightarrow> runnable' \<noteq> 0 \<and> curPrio = targetPrio \<or> runnable' = 0 \<or> curPrio \<noteq> targetPrio)} \<inter> UNIV \<inter> - \<lbrace>fastfail \<and> \<not> rv\<rbrace>}
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and (\<lambda>a. (Invariants_H.valid_queues a \<and> tcb_at' candidate a \<and> valid_objs' a \<and> invs' a \<and> st_tcb_at' runnable' candidate a \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> ksCurThread a \<noteq> candidate)) \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues a \<and> tcb_at' candidate a \<and> valid_objs' a \<and> invs' a \<and> st_tcb_at' runnable' candidate a \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> ksCurThread a \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' a \<and> tcb_at' candidate a) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' a \<and> tcb_at' candidate a) \<and> curThread = ksCurThread a \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread a) a \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate a)) b\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio fastfail' rv. \<Gamma>\<turnstile>\<^bsub>/?F3682 curThread candidate runnable' rv' it targetPrio curPrio (to_bool fastfail') fastfail' rv\<^esub> (?R'3682 curThread candidate runnable' rv' it targetPrio curPrio (to_bool fastfail') fastfail' rv) \<acute>ret__int :== (if fastfail' \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__unsigned_long :== CALL isHighestPrio_'proc(\<acute>ksCurDomain,h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C'']))));;
\<acute>ret__int :== (if \<acute>ret__unsigned_long = 0 then 1 else 0)
FI \<lbrace>True\<rbrace>
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and (\<lambda>a. (Invariants_H.valid_queues a \<and> tcb_at' candidate a \<and> valid_objs' a \<and> invs' a \<and> st_tcb_at' runnable' candidate a \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> ksCurThread a \<noteq> candidate)) \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues a \<and> tcb_at' candidate a \<and> valid_objs' a \<and> invs' a \<and> st_tcb_at' runnable' candidate a \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> ksCurThread a \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' a \<and> tcb_at' candidate a) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' a \<and> tcb_at' candidate a) \<and> curThread = ksCurThread a \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread a) a \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate a)) b\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> ?R'3682 curThread candidate runnable' rv' it targetPrio curPrio rv (fastfail_' s) rva}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (9 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ((\<lambda>b. (a \<longrightarrow> ((\<lambda>a. rv \<le> maxDomain \<and> bitmapQ_no_L1_orphans a) and (\<lambda>b. a) and obj_at' (\<lambda>x. a) (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr candidate))) b) \<and> (\<not> a \<longrightarrow> True)) and (\<lambda>a. (Invariants_H.valid_queues a \<and> tcb_at' candidate a \<and> valid_objs' a \<and> invs' a \<and> st_tcb_at' runnable' candidate a \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> ksCurThread a \<noteq> candidate)) \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues a \<and> tcb_at' candidate a \<and> valid_objs' a \<and> invs' a \<and> st_tcb_at' runnable' candidate a \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> ksCurThread a \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' a \<and> tcb_at' candidate a) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' a \<and> tcb_at' candidate a) \<and> curThread = ksCurThread a \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread a) a \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate a)) b\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 5. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 6. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 8. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (9 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?R2765 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>a b. (a \<longrightarrow> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> tcb_at' candidate b) \<and> Invariants_H.valid_queues b \<and> tcb_at' candidate b \<and> valid_objs' b \<and> invs' b \<and> st_tcb_at' runnable' candidate b \<and> (ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> ksCurThread b \<noteq> candidate) \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues b \<and> tcb_at' candidate b \<and> valid_objs' b \<and> invs' b \<and> st_tcb_at' runnable' candidate b \<and> (ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> ksCurThread b \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' b \<and> tcb_at' candidate b) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' b \<and> tcb_at' candidate b) \<and> curThread = ksCurThread b \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread b) b \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate b\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and ?R2765 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 5. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 6. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 8. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (10 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<lbrace>?P5364 curThread candidate runnable' rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>rv s. ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s\<rbrace>
 2. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?P'5364 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate) \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s\<rbrace>
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 4. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 5. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. ?P5364 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s \<and> ?P'5364 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 6. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 7. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 8. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 9. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 10. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (9 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?P'5364 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>rv s. Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate) \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> (ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> candidate)) \<and> (runnable'a = 0 \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. (ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s) \<and> ?P'5364 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 5. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 6. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 8. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (9 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?P'5364 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>r s. Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> (runnable'a \<noteq> 0 \<and> curPrio = targetPrio \<longrightarrow> Invariants_H.valid_queues s \<and> tcb_at' candidate s \<and> valid_objs' s \<and> invs' s \<and> st_tcb_at' runnable' candidate s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread) \<and> (runnable'a = 0 \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> (curPrio \<noteq> targetPrio \<longrightarrow> invs' s \<and> tcb_at' candidate s) \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. (ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s) \<and> ?P'5364 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 5. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 6. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 8. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (9 subgoals):
 1. \<And>curThread candidate runnable'a rv' it targetPrio curPrio. \<lbrace>?P'5364 curThread candidate runnable'a rv' it targetPrio curPrio\<rbrace> scheduleSwitchThreadFastfail curThread it curPrio targetPrio \<lbrace>\<lambda>r s. invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = targetPrio) candidate s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = curPrio) (ksCurThread s) s\<rbrace>
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 3. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 4. \<And>curThread candidate runnable' rv'. \<lbrace>?Q1677 curThread candidate runnable' ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. (ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s) \<and> ?P'5364 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 5. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 6. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 7. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 8. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 9. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (8 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?F2765 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?R'2765 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>ret__int :== (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate} (\<acute>ret__int :== (if h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(\<acute>ksCurThread\<rightarrow>[''tcbPriority_C''])) then 1 else 0)))
FI;;
\<acute>fastfail :== SCAST(32 signed \<rightarrow> 32) \<acute>ret__int {s. \<forall>rv. rv = to_bool (fastfail_' s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> {sa. sa\<lparr>ret__int_' := if fastfail_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s. prio_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[[Char False False rv False rv rv rv False, Char rv rv False False False rv rv False, Char False rv False False False rv rv False, Char False False False False rv False rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char rv rv rv rv False rv rv False, Char False rv False False rv rv rv False, Char rv False False rv False rv rv False, Char False False rv False rv rv rv False, Char rv False False rv rv rv rv False, Char rv rv rv rv rv False rv False, Char rv rv False False False False rv False]]))) (dom_'_update (\<lambda>_. ksCurDomain_' (globals s)) s) \<in> UNIV \<inter> \<lbrace>\<acute>dom = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> \<lbrace>\<acute>prio = UCAST(8 \<rightarrow> 32) targetPrio\<rbrace>} \<inter> \<lbrace>rv\<rbrace> \<inter> \<lbrace>rv\<rbrace>) \<and> (\<not> rv \<longrightarrow> s \<in> \<lbrace>\<acute>ret__int = 0\<rbrace>)}} \<inter> \<lbrace>((if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if \<^bsup>s\<^esup>fastfail \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> True)\<rbrace>}}
 2. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> ?R'2765 curThread candidate runnable' rv' it targetPrio curPrio}
 3. \<And>curThread candidate runnable'a rv'. \<lbrace>?Q1677 curThread candidate runnable'a ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. (ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s) \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) (ksCurThread s) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 4. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 5. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 6. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 7. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 8. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (7 subgoals):
 1. \<And>curThread candidate runnable' rv' it targetPrio curPrio. \<Gamma>\<turnstile>\<^bsub>/?Ft2228 curThread candidate runnable' rv' it targetPrio curPrio\<^esub> (?P'2228 curThread candidate runnable' rv' it targetPrio curPrio) \<acute>candidate :== \<acute>ksSchedulerAction {s. \<forall>rv. candidate_' s = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> s \<in> \<lbrace>\<forall>rv. (if \<acute>ksCurThread = \<acute>ksIdleThread then 1 else 0) = from_bool (curThread = it) \<longrightarrow> (curThread = it \<longrightarrow> True) \<and> (curThread \<noteq> it \<longrightarrow> True)\<rbrace> \<inter> UNIV \<inter> {s. ((if ksCurThread_' (globals s) = ksIdleThread_' (globals s) then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (SCAST(32 signed \<rightarrow> 32) (if ksCurThread_' (globals s) = ksIdleThread_' (globals s) then 1 else 0)) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) targetPrio) \<and> (\<not> to_bool (SCAST(32 signed \<rightarrow> 32) (if ksCurThread_' (globals s) = ksIdleThread_' (globals s) then 1 else 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if ksCurThread_' (globals s) = ksIdleThread_' (globals s) then 1 else 0) = 0)) \<and> (\<not> (if ksCurThread_' (globals s) = ksIdleThread_' (globals s) then 1 else 0) \<noteq> 0 \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (SCAST(32 signed \<rightarrow> 32) (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0)) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) targetPrio) \<and> (\<not> to_bool (SCAST(32 signed \<rightarrow> 32) (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0)) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then 1 else 0) = 0))}}
 2. \<And>curThread candidate runnable'a rv'. \<lbrace>?Q1677 curThread candidate runnable'a ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. (ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s) \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) (ksCurThread s) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 3. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 4. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> ?P'2230 curThread candidate runnable' y (was_runnable_' sa) (xfdc s) rv tcb tcba \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>sa\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 5. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 6. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 7. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}}
flex-flex pairs:
\<lambda>curThread candidate runnable'. ?P'2230 curThread candidate runnable' () runnable' \<equiv>\<^sup>? \<lambda>curThread candidate runnable' rv' it tcb tcba. ?P'2228 curThread candidate runnable' rv' it (tcbPriority tcb) (tcbPriority tcba) proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable'a rv'. \<lbrace>?Q1677 curThread candidate runnable'a ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> curThread \<noteq> it \<longrightarrow> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. fastfail_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (from_bool (curThread = it))) sa \<in> {s'. (s, s') \<in> rf_sr \<and> to_bool (fastfail_' s')}}) and (\<lambda>s. curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) and (\<lambda>s. it = ksIdleThread s \<and> curThread = ksCurThread s) and (\<lambda>s. (ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s) \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) (ksCurThread s) s) and (\<lambda>s. ksSchedulerAction s = SwitchToThread candidate)) s)\<rbrace>
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable'a. \<lbrace>?Q1677 curThread candidate runnable'a ()\<rbrace> getIdleThread \<lbrace>\<lambda>it s. \<forall>tcb. ko_at' tcb candidate s \<longrightarrow> (\<forall>tcba. ko_at' tcba curThread s \<longrightarrow> (curThread \<noteq> it \<longrightarrow> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) curThread s \<and> curThread = ksCurThread s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s) \<and> it = ksIdleThread s \<and> curThread = ksCurThread s \<and> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> obj_at' (\<lambda>tcba. tcbPriority tcba = tcbPriority tcb) candidate s \<and> obj_at' (\<lambda>tcb. tcbPriority tcb = tcbPriority tcba) (ksCurThread s) s \<and> ksSchedulerAction s = SwitchToThread candidate)\<rbrace>
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable'a. \<lbrace>?Q1677 curThread candidate runnable'a ()\<rbrace> getIdleThread \<lbrace>\<lambda>r s. \<forall>x. ko_at' x candidate s \<longrightarrow> (\<forall>xa. ko_at' xa curThread s \<longrightarrow> (curThread \<noteq> r \<longrightarrow> ko_at' xa curThread s \<and> curThread = ksCurThread s \<and> ko_at' x candidate s) \<and> r = ksIdleThread s \<and> curThread = ksCurThread s \<and> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> ko_at' x candidate s \<and> ko_at' xa (ksCurThread s) s \<and> ksSchedulerAction s = SwitchToThread candidate)\<rbrace>
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable'a. \<lbrace>?Q1677 curThread candidate runnable'a ()\<rbrace> getIdleThread \<lbrace>\<lambda>r s. (\<exists>x. ko_at' x candidate s) \<longrightarrow> (\<forall>x. ko_at' x curThread s \<longrightarrow> (curThread \<noteq> r \<longrightarrow> curThread = ksCurThread s) \<and> r = ksIdleThread s \<and> curThread = ksCurThread s \<and> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> ko_at' x (ksCurThread s) s \<and> ksSchedulerAction s = SwitchToThread candidate)\<rbrace>
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>?Q1677 curThread candidate runnable'\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (5 subgoals):
 1. \<And>curThread candidate runnable'a. \<lbrace>?R1682 curThread candidate (runnable'a \<noteq> 0)\<rbrace> when (runnable'a \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a b. (\<exists>x. ko_at' x candidate b) \<longrightarrow> (\<forall>x. ko_at' x curThread b \<longrightarrow> (curThread \<noteq> ksIdleThread b \<longrightarrow> curThread = ksCurThread b) \<and> ksIdleThread b = ksIdleThread b \<and> curThread = ksCurThread b \<and> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> tcb_at' candidate b \<and> invs' b \<and> curThread = ksCurThread b \<and> ksSchedulerAction b \<noteq> ResumeCurrentThread \<and> tcb_at' candidate b \<and> st_tcb_at' runnable' candidate b \<and> ko_at' x (ksCurThread b) b \<and> ksSchedulerAction b = SwitchToThread candidate)\<rbrace>
 2. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 3. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 4. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (5 subgoals):
 1. \<And>curThread candidate runnable'a. \<lbrace>?R1682 curThread candidate (runnable'a \<noteq> 0)\<rbrace> when (runnable'a \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a b. (\<exists>x. ko_at' x candidate b) \<longrightarrow> (\<forall>x. ko_at' x curThread b \<longrightarrow> (curThread \<noteq> ksIdleThread b \<longrightarrow> curThread = ksCurThread b) \<and> curThread = ksCurThread b \<and> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> tcb_at' candidate b \<and> invs' b \<and> curThread = ksCurThread b \<and> ksSchedulerAction b \<noteq> ResumeCurrentThread \<and> tcb_at' candidate b \<and> st_tcb_at' runnable' candidate b \<and> ko_at' x (ksCurThread b) b \<and> ksSchedulerAction b = SwitchToThread candidate)\<rbrace>
 2. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 3. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 4. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (5 subgoals):
 1. \<And>curThread candidate runnable'a. \<lbrace>?R1682 curThread candidate (runnable'a \<noteq> 0)\<rbrace> when (runnable'a \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>a b. (\<exists>x. ko_at' x candidate b) \<longrightarrow> (\<forall>x. ko_at' x curThread b \<longrightarrow> (curThread \<noteq> ksIdleThread b \<longrightarrow> curThread = ksCurThread b) \<and> curThread = ksCurThread b \<and> ksCurDomain b \<le> maxDomain \<and> bitmapQ_no_L1_orphans b \<and> tcb_at' candidate b \<and> invs' b \<and> curThread = ksCurThread b \<and> ksSchedulerAction b \<noteq> ResumeCurrentThread \<and> tcb_at' candidate b \<and> st_tcb_at' runnable' candidate b \<and> ko_at' x (ksCurThread b) b \<and> ksSchedulerAction b = SwitchToThread candidate)\<rbrace>
 2. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 3. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 4. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>curThread candidate runnable'a rv s. invs' s \<and> ksCurThread s = curThread \<and> ksSchedulerAction s = SwitchToThread candidate \<Longrightarrow> (\<exists>x. ko_at' x candidate s) \<longrightarrow> (\<forall>x. ko_at' x curThread s \<longrightarrow> (curThread \<noteq> ksIdleThread s \<longrightarrow> curThread = ksCurThread s) \<and> curThread = ksCurThread s \<and> ksCurDomain s \<le> maxDomain \<and> bitmapQ_no_L1_orphans s \<and> tcb_at' candidate s \<and> invs' s \<and> curThread = ksCurThread s \<and> ksSchedulerAction s \<noteq> ResumeCurrentThread \<and> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s \<and> ko_at' x (ksCurThread s) s \<and> ksSchedulerAction s = SwitchToThread candidate)
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>rv s. invs' s \<and> ksCurThread s = curThread \<and> ksSchedulerAction s = SwitchToThread candidate\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (6 subgoals):
 1. \<And>candidate s x xa. \<lbrakk>invs' s; ksSchedulerAction s = SwitchToThread candidate; ko_at' x candidate s; ko_at' xa (ksCurThread s) s\<rbrakk> \<Longrightarrow> tcb_at' candidate s \<and> st_tcb_at' runnable' candidate s
 2. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>rv s. invs' s \<and> ksCurThread s = curThread \<and> ksSchedulerAction s = SwitchToThread candidate\<rbrace>
 3. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 4. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 5. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 6. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (5 subgoals):
 1. \<And>curThread candidate runnable'. \<lbrace>?R1682 curThread candidate (runnable' \<noteq> 0)\<rbrace> when (runnable' \<noteq> 0) (tcbSchedEnqueue curThread) \<lbrace>\<lambda>rv s. invs' s \<and> ksCurThread s = curThread \<and> ksSchedulerAction s = SwitchToThread candidate\<rbrace>
 2. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s'. \<forall>rv. s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s'. \<forall>tcba ctcb. cslift s' (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcba ctcb \<longrightarrow> s' \<in> {s. ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))} \<inter> UNIV}}} \<inter> \<lbrace>\<^bsup>s\<^esup>was_runnable = runnable'\<rbrace>} \<inter> - \<lbrace>\<acute>ksSchedulerAction = tcb_Ptr 1\<rbrace>}
 3. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and ?R1682 curThread candidate a\<rbrace>
 4. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 5. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (4 subgoals):
 1. \<And>curThread candidate runnable'. \<Gamma>\<turnstile>\<^bsub>/?F1677 curThread candidate runnable'\<^esub> (?R'1678 curThread candidate (runnable' \<noteq> 0) runnable') IF runnable' \<noteq> 0 THEN
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) true;;
CALL tcbSchedEnqueue_'proc(\<acute>ksCurThread)
ELSE
  \<acute>was_runnable :== SCAST(32 signed \<rightarrow> 32) false
FI {s. (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> was_runnable_' s = runnable' \<and> ksSchedulerAction_' (globals s) \<noteq> tcb_Ptr 1}
 2. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and (if a then \<lambda>a. (invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread)) a \<and> ksCurThread a = curThread \<and> ksSchedulerAction a = SwitchToThread candidate else (\<lambda>s. invs' s \<and> ksCurThread s = curThread \<and> ksSchedulerAction s = SwitchToThread candidate))\<rbrace>
 3. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> ?R'1678 curThread candidate rv (ret__unsigned_long_' s)}
 4. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (3 subgoals):
 1. \<And>curThread candidate. \<lbrace>?R1336 curThread (SwitchToThread candidate) candidate\<rbrace> isRunnable curThread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' curThread and valid_objs') s) and (\<lambda>s. \<not> a \<longrightarrow> True) and (if a then \<lambda>a. (invs' and st_tcb_at' runnable' curThread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> curThread)) a \<and> ksCurThread a = curThread \<and> ksSchedulerAction a = SwitchToThread candidate else (\<lambda>s. invs' s \<and> ksCurThread s = curThread \<and> ksSchedulerAction s = SwitchToThread candidate))\<rbrace>
 2. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> {sa. (rv \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals sa) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals sa) = ksIdleThread_' (globals sa) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals sa) \<noteq> ksIdleThread_' (globals sa) \<longrightarrow> t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> SCAST(32 signed \<rightarrow> 32) true = ret__unsigned_long_' s \<and> ksSchedulerAction_' (globals sa) \<noteq> tcb_Ptr 1) \<and> (\<not> rv \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift sa (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift sa (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals sa) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals sa) = ksIdleThread_' (globals sa) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals sa) \<noteq> ksIdleThread_' (globals sa) \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> SCAST(32 signed \<rightarrow> 32) false = ret__unsigned_long_' s \<and> ksSchedulerAction_' (globals sa) \<noteq> tcb_Ptr 1)}}
 3. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and ?R1336 rv rva x)) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (2 subgoals):
 1. \<And>curThread candidate. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1331 curThread (SwitchToThread candidate) candidate) \<acute>ret__unsigned_long :== CALL isRunnable_'proc(\<acute>ksCurThread) {s. \<forall>rv. rv = to_bool (ret__unsigned_long_' s) \<longrightarrow> s \<in> ({s. was_runnable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s \<in> {s. tcb_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr curThread\<rbrace>}} \<inter> \<lbrace>rv\<rbrace> \<union> UNIV \<inter> - \<lbrace>rv\<rbrace>) \<inter> {sa. (rv \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals sa) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals sa) = ksIdleThread_' (globals sa) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals sa) \<noteq> ksIdleThread_' (globals sa) \<longrightarrow> t \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> SCAST(32 signed \<rightarrow> 32) true = ret__unsigned_long_' s \<and> ksSchedulerAction_' (globals sa) \<noteq> tcb_Ptr 1) \<and> (\<not> rv \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift sa (tcb_ptr_to_ctcb_ptr candidate) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift sa (tcb_ptr_to_ctcb_ptr curThread) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals sa) = tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (ksCurThread_' (globals sa) = ksIdleThread_' (globals sa) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals sa) \<noteq> ksIdleThread_' (globals sa) \<longrightarrow> sa \<Turnstile>\<^sub>c ksCurThread_' (globals sa) \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr candidate \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr candidate\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) &(ksCurThread_' (globals sa)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> SCAST(32 signed \<rightarrow> 32) false = ret__unsigned_long_' s \<and> ksSchedulerAction_' (globals sa) \<noteq> tcb_Ptr 1)}}
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>s. st_tcb_at' runnable' rv a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') s) and (\<lambda>s. \<not> st_tcb_at' runnable' rv a \<longrightarrow> True) and (if st_tcb_at' runnable' rv a then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksCurThread a = rv \<and> ksSchedulerAction a = rva else (\<lambda>s. invs' s \<and> ksCurThread s = rv \<and> ksSchedulerAction s = rva))) a))) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> ?R'1331 rv rva x} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>rv. ksCurThread s = rv \<longrightarrow> (\<forall>rva. ksSchedulerAction s = rva \<longrightarrow> (rva = ResumeCurrentThread \<longrightarrow> True) \<and> (rva = ChooseNewThread \<longrightarrow> (tcb_at' rv and (\<lambda>s. ((\<lambda>_. True) and (\<lambda>sa. st_tcb_at' runnable' rv s \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') sa) and (\<lambda>sa. \<not> st_tcb_at' runnable' rv s \<longrightarrow> True) and (if st_tcb_at' runnable' rv s then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksSchedulerAction a = ChooseNewThread \<and> True else (\<lambda>s. invs' s \<and> ksSchedulerAction s = ChooseNewThread \<and> True))) s)) s) \<and> (\<forall>x. rva = SwitchToThread x \<longrightarrow> ((\<lambda>s. ksSchedulerAction s = rva \<and> invs' s) and (tcb_at' rv and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>s. st_tcb_at' runnable' rv a \<longrightarrow> (Invariants_H.valid_queues and tcb_at' rv and valid_objs') s) and (\<lambda>s. \<not> st_tcb_at' runnable' rv a \<longrightarrow> True) and (if st_tcb_at' runnable' rv a then \<lambda>a. (invs' and st_tcb_at' runnable' rv and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread \<longrightarrow> ksCurThread s \<noteq> rv)) a \<and> ksCurThread a = rv \<and> ksSchedulerAction a = rva else (\<lambda>s. invs' s \<and> ksCurThread s = rv \<and> ksSchedulerAction s = rva))) a))) s))) \<and> s' \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. \<forall>rva. cscheduler_action_relation rva (ksSchedulerAction_' (globals s)) \<longrightarrow> s \<in> {s. rva = ResumeCurrentThread \<longrightarrow> s \<in> \<lbrace>\<acute>ksSchedulerAction = NULL\<rbrace> \<inter> - \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> ({s. rva = ChooseNewThread \<longrightarrow> s \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> ksSchedulerAction_' (globals s) = tcb_Ptr 1)}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. rva = SwitchToThread x \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = rva \<and> invs' s \<longrightarrow> s' \<in> {s. \<forall>v. was_runnable_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr rv\<rbrace>} \<inter> {s. cslift s (ksCurThread_' (globals s)) \<noteq> None \<and> (\<forall>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<longrightarrow> (ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<and> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<or> \<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}))) \<and> (to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> t \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> SCAST(32 signed \<rightarrow> 32) true = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<and> ksSchedulerAction_' (globals s) \<noteq> tcb_Ptr 1) \<and> (\<not> to_bool (from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x})) \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s (tcb_ptr_to_ctcb_ptr rv) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s) = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (ksCurThread_' (globals s) = ksIdleThread_' (globals s) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (ksCurThread_' (globals s) \<noteq> ksIdleThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<longrightarrow> s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) &(ksCurThread_' (globals s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> SCAST(32 signed \<rightarrow> 32) false = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s (ksCurThread_' (globals s)))))) \<in> insert (SCAST(32 signed \<rightarrow> 32) ThreadState_Running) {x. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart = x}) \<and> ksSchedulerAction_' (globals s) \<noteq> tcb_Ptr 1))}} \<inter> \<lbrace>\<acute>ksSchedulerAction \<noteq> NULL\<rbrace>}}})}} proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation rv (ksSchedulerAction_' (globals s'))\<rbrakk> \<Longrightarrow> (rv = ResumeCurrentThread \<longrightarrow> ksSchedulerAction_' (globals s') = NULL) \<and> (rv = ChooseNewThread \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) \<and> (\<forall>x. rv = SwitchToThread x \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = SwitchToThread x \<and> invs' s) \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation rv (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s\<rbrakk> \<Longrightarrow> (rv = ResumeCurrentThread \<longrightarrow> ksSchedulerAction_' (globals s') = NULL) \<and> (rv = ChooseNewThread \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) \<and> (\<forall>x. rv = SwitchToThread x \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = SwitchToThread x \<and> invs' s) \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation rv (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> (rv = ResumeCurrentThread \<longrightarrow> ksSchedulerAction_' (globals s') = NULL) \<and> (rv = ChooseNewThread \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) \<and> (\<forall>x. rv = SwitchToThread x \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = SwitchToThread x \<and> invs' s) \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) proof (prove)
goal (2 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation rv (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> rv = ResumeCurrentThread \<longrightarrow> ksSchedulerAction_' (globals s') = NULL
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation rv (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> (rv = ChooseNewThread \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) \<and> (\<forall>x. rv = SwitchToThread x \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = SwitchToThread x \<and> invs' s) \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation rv (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> (rv = ChooseNewThread \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) \<and> (\<forall>x. rv = SwitchToThread x \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ksSchedulerAction s = SwitchToThread x \<and> invs' s) \<longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation ChooseNewThread (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL
 2. \<And>s s' x sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation (SwitchToThread x) (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s; (sa, s') \<in> rf_sr; ksSchedulerAction sa = SwitchToThread x; invs' sa\<rbrakk> \<Longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation ChooseNewThread (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s; \<exists>ko ko'. ko_at' ko (ksCurThread s) s \<and> True \<and> cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> ksSchedulerAction_' (globals s') = tcb_Ptr 1) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL
 2. \<And>s s' x sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation (SwitchToThread x) (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s; (sa, s') \<in> rf_sr; ksSchedulerAction sa = SwitchToThread x; invs' sa\<rbrakk> \<Longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' x sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation (SwitchToThread x) (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s; (sa, s') \<in> rf_sr; ksSchedulerAction sa = SwitchToThread x; invs' sa\<rbrakk> \<Longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' x sa. \<lbrakk>(s, s') \<in> rf_sr; invs' s; cscheduler_action_relation (SwitchToThread x) (ksSchedulerAction_' (globals s')); sch_act_wf (ksSchedulerAction s) s; tcb_at' (ksCurThread s) s; (sa, s') \<in> rf_sr; ksSchedulerAction sa = SwitchToThread x; invs' sa; \<exists>ko ko'. ko_at' ko (ksCurThread s) s \<and> True \<and> cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (\<exists>y. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some y) \<and> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)))))) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> ksSchedulerAction_' (globals s') \<noteq> tcb_Ptr 1)) \<and> ksSchedulerAction_' (globals s') \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' x sa ko ko'. \<lbrakk>ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x; tcb_at' (ksCurThread s) s; ksSchedulerAction sa = SwitchToThread x; sch_act_wf (ksSchedulerAction s) s; case ksSchedulerAction s of ResumeCurrentThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = NULL | ChooseNewThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1 | SwitchToThread p' \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_ptr_to_ctcb_ptr p'; ko_at' ko (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; ctcb_relation ko ko'; st_tcb_at' runnable' x sa; tcb_in_cur_domain' x sa\<rbrakk> \<Longrightarrow> ((\<exists>t. ret__unsigned_long_' t = from_bool (tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart)) \<longrightarrow> (tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<or> tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<or> tsType_CL (thread_state_lift (tcbState_C ko')) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C ko')) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<and> (tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> tcb_ptr_to_ctcb_ptr x \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>t tcb. (\<exists>ctcb. cslift t (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb ctcb. cslift t (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> t \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals t))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> tcb_ptr_to_ctcb_ptr x \<noteq> tcb_Ptr 1) \<and> (tsType_CL (thread_state_lift (tcbState_C ko')) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running \<and> tsType_CL (thread_state_lift (tcbState_C ko')) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<longrightarrow> (\<forall>tcb. (\<exists>ctcb. cslift s' (tcb_ptr_to_ctcb_ptr x) = Some ctcb \<and> ctcb_relation tcb ctcb) \<longrightarrow> (\<exists>tcb. ctcb_relation tcb ko') \<longrightarrow> (tcb_ptr_to_ctcb_ptr (ksCurThread s) = ksIdleThread_' (globals s') \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (tcb_ptr_to_ctcb_ptr (ksCurThread s) \<noteq> ksIdleThread_' (globals s') \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s) \<longrightarrow> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr x \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> (to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) = UCAST(8 \<rightarrow> 32) (tcbPriority tcb)) \<and> (\<not> to_bool (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) \<longrightarrow> (if h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbPriority_C''])) < h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rightarrow>[''tcbPriority_C''])) then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = 0))) \<and> tcb_ptr_to_ctcb_ptr x \<noteq> tcb_Ptr 1)) \<and> tcb_ptr_to_ctcb_ptr x \<noteq> NULL proof (prove)
goal (4 subgoals):
 1. \<And>s s' x sa ko ko' t. \<lbrakk>ksSchedulerAction_' (globals s') = tcb_Ptr 1; tcb_at' (ksCurThread s) s; ksSchedulerAction sa = SwitchToThread x; sch_act_wf (ksSchedulerAction s) s; case ksSchedulerAction s of ResumeCurrentThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = NULL | ChooseNewThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1 | SwitchToThread p' \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_ptr_to_ctcb_ptr p'; ko_at' ko (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; st_tcb_at' runnable' x sa; tcb_in_cur_domain' x sa; tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Running; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) true; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); tcbQueued ko = (tcbQueued_CL (thread_state_lift (tcbState_C ko')) \<noteq> 0); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' x sa ko ko' t. \<lbrakk>ksSchedulerAction_' (globals s') = tcb_Ptr 1; tcb_at' (ksCurThread s) s; ksSchedulerAction sa = SwitchToThread x; sch_act_wf (ksSchedulerAction s) s; case ksSchedulerAction s of ResumeCurrentThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = NULL | ChooseNewThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1 | SwitchToThread p' \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_ptr_to_ctcb_ptr p'; ko_at' ko (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; st_tcb_at' runnable' x sa; tcb_in_cur_domain' x sa; tsType_CL (thread_state_lift (tcbState_C ko')) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) true; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); tcbQueued ko = (tcbQueued_CL (thread_state_lift (tcbState_C ko')) \<noteq> 0); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1\<rbrakk> \<Longrightarrow> False
 3. \<And>s s' x sa ko ko' t. \<lbrakk>ksSchedulerAction_' (globals s') = tcb_Ptr 1; tcb_at' (ksCurThread s) s; ksSchedulerAction sa = SwitchToThread x; sch_act_wf (ksSchedulerAction s) s; case ksSchedulerAction s of ResumeCurrentThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = NULL | ChooseNewThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1 | SwitchToThread p' \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_ptr_to_ctcb_ptr p'; ko_at' ko (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; st_tcb_at' runnable' x sa; tcb_in_cur_domain' x sa; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; tcbFaultHandler ko = tcbFaultHandler_C ko'; tsType_CL (thread_state_lift (tcbState_C ko')) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Running; tsType_CL (thread_state_lift (tcbState_C ko')) \<noteq> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); tcbQueued ko = (tcbQueued_CL (thread_state_lift (tcbState_C ko')) \<noteq> 0); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1\<rbrakk> \<Longrightarrow> False
 4. \<And>s s' x sa ko ko'. \<lbrakk>ksSchedulerAction_' (globals s') = NULL; tcb_at' (ksCurThread s) s; ksSchedulerAction sa = SwitchToThread x; sch_act_wf (ksSchedulerAction s) s; case ksSchedulerAction s of ResumeCurrentThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = NULL | ChooseNewThread \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_Ptr 1 | SwitchToThread p' \<Rightarrow> tcb_ptr_to_ctcb_ptr x = tcb_ptr_to_ctcb_ptr p'; ko_at' ko (ksCurThread s) s; cslift s' (tcb_ptr_to_ctcb_ptr (ksCurThread s)) = Some ko'; st_tcb_at' runnable' x sa; tcb_in_cur_domain' x sa; tcbFaultHandler ko = tcbFaultHandler_C ko'; cthread_state_relation (tcbState ko) (tcbState_C ko', tcbFault_C ko'); tcbIPCBuffer ko = tcbIPCBuffer_C ko'; carch_tcb_relation (tcbArch ko) (tcbArch_C ko'); tcbQueued ko = (tcbQueued_CL (thread_state_lift (tcbState_C ko')) \<noteq> 0); UCAST(8 \<rightarrow> 32) (tcbDomain ko) = tcbDomain_C ko'; UCAST(8 \<rightarrow> 32) (tcbPriority ko) = tcbPriority_C ko'; UCAST(8 \<rightarrow> 32) (tcbMCP ko) = tcbMCP_C ko'; tcbTimeSlice ko = unat (tcbTimeSlice_C ko'); cfault_rel (tcbFault ko) (seL4_Fault_lift (tcbFault_C ko')) (lookup_fault_lift (tcbLookupFailure_C ko')); option_to_ptr (tcbBoundNotification ko) = tcbBoundNotification_C ko'; tcb_ptr_to_ctcb_ptr x = NULL\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!