theory ADT_IF

lemma invs_if_Step_ADT_A_if:
  notes active_from_running[simp]
  shows "\<lbrakk> invs_if s; (s,t) \<in> Step (ADT_A_if utf) e \<rbrakk> \<Longrightarrow> invs_if t" apply (clarsimp simp: ADT_A_if_def global_automaton_if_def
                        invs_if_def Invs_def cur_thread_context_of_def
         | rule guarded_active_ct_cur_domain)+ apply (elim disjE) apply (clarsimp simp: kernel_call_A_if_def) apply (frule kernel_entry_if_was_not_Interrupt) apply (frule use_valid[OF _ kernel_entry_if_det_inv]) apply simp apply simp apply (erule use_valid) apply (rule current_aag_lift) apply (wp kernel_entry_if_invs kernel_entry_silc_inv[where st'=s0_internal]
                       kernel_entry_pas_refined[where st=s0_internal]
                       kernel_entry_if_valid_sched kernel_entry_if_only_timer_irq_inv
                       kernel_entry_if_domain_sep_inv kernel_entry_if_guarded_pas_domain
                       kernel_entry_if_domain_fields kernel_entry_if_idle_equiv
                       kernel_entry_if_domain_time_sched_action
                       hoare_false_imp ct_idle_lift
                    | clarsimp intro!: guarded_pas_is_subject_current_aag[rule_format]
                    | intro conjI)+ apply (rule guarded_pas_is_subject_current_aag[rule_format],assumption+) apply (simp add: schact_is_rct_def)+ apply (rule guarded_pas_is_subject_current_aag[rule_format],assumption+) apply (simp add: ct_active_not_idle' | elim exE)+ apply (simp add: kernel_call_A_if_def | elim exE conjE)+ apply (rule context_conjI) apply (erule use_valid) apply (rule kernel_entry_if_invs,simp) apply (subgoal_tac "idle_equiv s0_internal ba") prefer 2 apply (erule use_valid) apply (rule kernel_entry_if_idle_equiv) apply simp apply (simp add: idle_equiv_context_equiv) apply (frule use_valid[OF _ kernel_entry_context],simp) apply (frule use_valid[OF _ kernel_entry_if_det_inv']) apply simp apply (simp split: unit.splits) apply (erule use_valid) apply (rule current_aag_lift) apply (wp hoare_vcg_const_imp_lift kernel_entry_if_invs
                      kernel_entry_silc_inv[where st'=s0_internal]
                      kernel_entry_pas_refined[where st=s0_internal]
                      kernel_entry_if_valid_sched kernel_entry_if_only_timer_irq_inv
                      kernel_entry_if_domain_sep_inv kernel_entry_if_guarded_pas_domain
                      kernel_entry_if_domain_time_sched_action
                      ct_idle_lift
                   | clarsimp intro: guarded_pas_is_subject_current_aag
                   | wp kernel_entry_if_domain_fields)+ apply (rule conjI, fastforce intro!: active_from_running) apply (simp add: schact_is_rct_def) apply (rule guarded_pas_is_subject_current_aag,assumption+) apply (simp_all only: silc_inv_cur pas_refined_cur guarded_pas_domain_cur) apply (simp | elim exE)+ apply (elim exE conjE) apply (clarsimp simp add: kernel_handle_preemption_if_def) apply (subgoal_tac "idle_equiv s0_internal ba \<and> invs ba") prefer 2 apply (erule use_valid) apply (wp handle_preemption_if_invs | simp)+ apply (clarsimp simp add: idle_equiv_context_equiv) apply (erule use_valid) apply (rule hoare_add_post[OF handle_preemption_context, OF TrueI], simp,
                 rule hoare_drop_imps) apply (wp handle_preemption_if_invs handle_preemption_if_domain_sep_inv
                    handle_preemption_if_domain_time_sched_action
                    handle_preemption_if_det_inv ct_idle_lift) apply fastforce apply (simp add: kernel_schedule_if_def | elim exE conjE)+ apply (erule use_valid) apply ((wp schedule_if_ct_running_or_ct_idle schedule_if_domain_time_nonzero'
                    schedule_if_domain_time_nonzero schedule_if_det_inv hoare_false_imp
                 | fastforce simp: invs_valid_idle)+)[2] apply (simp add: kernel_exit_A_if_def | elim exE conjE)+ apply (frule state_unchanged[OF kernel_exit_if_inv]) apply (frule use_valid[OF _ kernel_exit_if_det_inv]) apply simp apply (clarsimp) apply (elim disjE) apply (simp add: ct_active_not_idle')+ apply (erule use_valid[OF _ exit_idle_context],simp+) apply (simp add: do_user_op_A_if_def check_active_irq_A_if_def | elim exE conjE)+ apply (frule use_valid[OF _ do_user_op_if_det_inv]) apply (frule use_valid[OF _ check_active_irq_if_User_det_inv]) apply simp apply simp apply (erule use_valid[OF _ check_active_irq_if_wp]) apply simp apply simp apply (erule use_valid, erule use_valid[OF _ check_active_irq_if_wp]) apply (rule_tac Q="\<lambda>a. (invs and ct_running) and
                              (\<lambda>b. valid_vspace_objs_if b \<and> valid_list b \<and> valid_sched b \<and>
                                   only_timer_irq_inv timer_irq s0_internal b \<and>
                                   silc_inv initial_aag s0_internal b \<and>
                                   pas_refined initial_aag b \<and>
                                   guarded_pas_domain initial_aag b \<and>
                                   idle_equiv s0_internal b \<and>
                                   domain_sep_inv False s0_internal b \<and>
                                   valid_domain_list b \<and> 0 < domain_time b \<and>
                                   scheduler_action b = resume_cur_thread)" in hoare_strengthen_post) apply ((wp do_user_op_if_invs ct_idle_lift | simp add: ct_active_not_idle' | clarsimp)+)[2] apply (erule use_valid[OF _ check_active_irq_if_wp]) apply (simp add: ct_in_state_def) apply (simp add: do_user_op_A_if_def check_active_irq_A_if_def | elim exE conjE)+ apply (frule use_valid[OF _ do_user_op_if_det_inv]) apply (frule use_valid[OF _ check_active_irq_if_User_det_inv]) apply simp apply simp apply (erule use_valid[OF _ check_active_irq_if_wp]) apply simp apply simp apply (erule use_valid, erule use_valid[OF _ check_active_irq_if_wp]) apply (rule_tac Q="\<lambda>a. (invs and ct_running) and
                             (\<lambda>b. valid_vspace_objs_if b \<and> valid_list b \<and> valid_sched b \<and>
                                  only_timer_irq_inv timer_irq s0_internal b \<and>
                                  silc_inv initial_aag s0_internal b \<and>
                                  pas_refined initial_aag b \<and>
                                  guarded_pas_domain initial_aag b \<and>
                                  idle_equiv s0_internal b \<and>
                                  domain_sep_inv False s0_internal b \<and>
                                  valid_domain_list b \<and> 0 < domain_time b \<and>
                                  scheduler_action b = resume_cur_thread)" in hoare_strengthen_post) apply ((wp do_user_op_if_invs | simp | clarsimp simp: ct_active_not_idle')+)[2] apply (erule use_valid[OF _ check_active_irq_if_wp]) apply (simp add: ct_in_state_def) apply (simp add: check_active_irq_A_if_def | elim exE conjE)+ apply (frule use_valid[OF _ check_active_irq_if_User_det_inv]) apply simp apply simp apply (erule use_valid[OF _ check_active_irq_if_wp]) apply (clarsimp simp: ct_in_state_def st_tcb_at_def obj_at_def) apply (simp add: check_active_irq_A_if_def | elim exE conjE)+ apply (frule use_valid[OF _ check_active_irq_context],simp) apply (frule use_valid[OF _ check_active_irq_if_Idle_det_inv]) apply simp apply simp apply (erule use_valid[OF _ check_active_irq_if_wp]) apply (simp add: ct_in_state_def idle_context_def) apply (simp add: check_active_irq_A_if_def | elim exE conjE)+ apply (frule use_valid[OF _ check_active_irq_if_Idle_det_inv]) apply simp apply simp apply (rule use_valid[OF _ check_active_irq_if_wp],assumption) apply (simp add: ct_in_state_def) apply (frule use_valid[OF _ check_active_irq_context],simp+) apply (simp add: idle_context_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs_if s; (s, t) \<in> Step (ADT_A_if utf) e\<rbrakk> \<Longrightarrow> invs_if t proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs (internal_state_if s); (\<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelPreempted) \<and> ((a, b), True, aa, ba) \<in> kernel_call_A_if e \<and> e \<noteq> Interrupt) \<or> (\<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e) \<or> (\<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)) \<or> (\<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)) \<or> (\<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)) \<or> (\<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)) \<or> (\<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)) \<or> (\<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))) \<or> (\<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))) \<or> (\<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelPreempted) \<and> ((a, b), True, aa, ba) \<in> kernel_call_A_if e \<and> e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ((Inl (), aa), ba) \<in> fst (kernel_entry_if e a b); ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv KernelPreempted (cur_context ba) ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ((Inl (), aa), ba) \<in> fst (kernel_entry_if e a b); ct_running b; scheduler_action b = resume_cur_thread; case fst (Inl (), aa) of Inl aa \<Rightarrow> e \<noteq> Interrupt | Inr a \<Rightarrow> True\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv KernelPreempted (cur_context ba) ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ((Inl (), aa), ba) \<in> fst (kernel_entry_if e a b); ct_running b; scheduler_action b = resume_cur_thread; case fst (Inl (), aa) of Inl aa \<Rightarrow> e \<noteq> Interrupt | Inr a \<Rightarrow> True\<rbrakk> \<Longrightarrow> (einvs and det_inv (KernelEntry e) a and ct_running and K (e \<noteq> Interrupt)) b
 2. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ((Inl (), aa), ba) \<in> fst (kernel_entry_if e a b); ct_running b; scheduler_action b = resume_cur_thread; case fst (Inl (), aa) of Inl aa \<Rightarrow> e \<noteq> Interrupt | Inr a \<Rightarrow> True; case fst (Inl (), aa) of Inl irq \<Rightarrow> det_inv KernelPreempted (cur_context ba) ba | Inr () \<Rightarrow> det_inv (KernelSchedule False) (cur_context ba) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv KernelPreempted (cur_context ba) ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ((Inl (), aa), ba) \<in> fst (kernel_entry_if e a b); ct_running b; scheduler_action b = resume_cur_thread; case fst (Inl (), aa) of Inl aa \<Rightarrow> e \<noteq> Interrupt | Inr a \<Rightarrow> True; case fst (Inl (), aa) of Inl irq \<Rightarrow> det_inv KernelPreempted (cur_context ba) ba | Inr () \<Rightarrow> det_inv (KernelSchedule False) (cur_context ba) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv KernelPreempted (cur_context ba) ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ((Inl (), aa), ba) \<in> fst (kernel_entry_if e a b); ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<lbrace>?P53 a b aa ba e\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>a b. invs b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv (current_aag b) s0_internal b \<and> domain_sep_inv False s0_internal b \<and> pas_refined (current_aag b) b \<and> guarded_pas_domain (current_aag b) b \<and> idle_equiv s0_internal b \<and> valid_domain_list b \<and> valid_vspace_objs_if b \<and> 0 < domain_time b \<and> (domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread) \<and> (ct_idle b \<longrightarrow> aa = idle_context b)\<rbrace>
 2. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> ?P53 a b aa ba e b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b aa ba e aag. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<lbrace>?P59 a b aa ba e aag\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>r s. invs s \<and> valid_list s \<and> valid_sched s \<and> only_timer_irq_inv timer_irq s0_internal s \<and> silc_inv aag s0_internal s \<and> domain_sep_inv False s0_internal s \<and> pas_refined aag s \<and> guarded_pas_domain aag s \<and> idle_equiv s0_internal s \<and> valid_domain_list s \<and> valid_vspace_objs_if s \<and> 0 < domain_time s \<and> (domain_time s = 0 \<longrightarrow> scheduler_action s = choose_new_thread) \<and> (ct_idle s \<longrightarrow> aa = idle_context s)\<rbrace>
 2. \<And>a b aa ba e P. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (cur_domain s)\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>r s. P (cur_domain s)\<rbrace>
 3. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> ?P59 a b aa ba e (current_aag b) b
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> is_subject (current_aag b) (cur_thread b)
 2. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> schact_is_rct b
 3. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> is_subject (current_aag b) (cur_thread b)
 4. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<not> ct_idle b
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> ct_active b
 2. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> schact_is_rct b
 3. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> is_subject (current_aag b) (cur_thread b)
 4. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<not> ct_idle b
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> is_subject (current_aag b) (cur_thread b)
 2. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<not> ct_idle b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> ct_active b
 2. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelPreempted); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelEntry e); t = ((aa, ba), KernelPreempted); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv KernelPreempted (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<not> ct_idle b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b aa ba e. s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; (e \<noteq> Interrupt \<longrightarrow> ct_running b) \<and> (ct_running b \<or> ct_idle b) \<and> scheduler_action b = resume_cur_thread; s = ((a, b), KernelEntry e) \<and> t = ((aa, ba), KernelSchedule (e = Interrupt)) \<and> ((a, b), False, aa, ba) \<in> kernel_call_A_if e\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb\<rbrakk> \<Longrightarrow> invs ba
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb\<rbrakk> \<Longrightarrow> \<lbrace>?P138 a b aa ba e bb r\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>a. invs\<rbrace>
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb\<rbrakk> \<Longrightarrow> ?P138 a b aa ba e bb r b
 3. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> idle_equiv s0_internal ba
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> idle_equiv s0_internal ba
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> \<lbrace>?P144 a b aa ba e bb r\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>a. idle_equiv s0_internal\<rbrace>
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> ?P144 a b aa ba e bb r b
 3. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_active s) and idle_equiv s0_internal and (\<lambda>s. ct_idle s \<longrightarrow> a = idle_context s)) b
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context s0_internal)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba; snd (Inr (), aa) = a\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context s0_internal)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba; snd (Inr (), aa) = a\<rbrakk> \<Longrightarrow> (einvs and det_inv (KernelEntry e) a and (\<lambda>s. ct_running s \<or> ct_idle s) and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s)) b
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba; snd (Inr (), aa) = a; det_inv (case fst (Inr (), aa) of Inl irq \<Rightarrow> KernelPreempted | Inr () \<Rightarrow> KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context s0_internal)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((aa, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), aa), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba; snd (Inr (), aa) = a; det_inv (case fst (Inr (), aa) of Inl irq \<Rightarrow> KernelPreempted | Inr () \<Rightarrow> KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context s0_internal)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); r = Inr (); ((Inr (), a), ba) \<in> fst (kernel_entry_if e a b); \<not> bb; invs ba; idle_equiv s0_internal ba; aa = a; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv (current_aag ba) s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined (current_aag ba) ba \<and> guarded_pas_domain (current_aag ba) ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time ba) \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> a = idle_context s0_internal)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba; idle_equiv s0_internal ba; aa = a; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<lbrace>?P163 a b aa ba e bb r\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>b c. valid_list c \<and> valid_sched c \<and> only_timer_irq_inv timer_irq s0_internal c \<and> silc_inv (current_aag c) s0_internal c \<and> domain_sep_inv False s0_internal c \<and> pas_refined (current_aag c) c \<and> guarded_pas_domain (current_aag c) c \<and> valid_domain_list c \<and> valid_vspace_objs_if c \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time c) \<and> (domain_time c = 0 \<longrightarrow> scheduler_action c = choose_new_thread) \<and> (ct_idle c \<longrightarrow> a = idle_context s0_internal)\<rbrace>
 2. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba; idle_equiv s0_internal ba; aa = a; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> ?P163 a b aa ba e bb r b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ba e bb r aag. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba; idle_equiv s0_internal ba; aa = a; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<lbrace>?P169 a b aa ba e bb r aag\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>r s. valid_list s \<and> valid_sched s \<and> only_timer_irq_inv timer_irq s0_internal s \<and> silc_inv aag s0_internal s \<and> domain_sep_inv False s0_internal s \<and> pas_refined aag s \<and> guarded_pas_domain aag s \<and> valid_domain_list s \<and> valid_vspace_objs_if s \<and> (e \<noteq> Interrupt \<longrightarrow> 0 < domain_time s) \<and> (domain_time s = 0 \<longrightarrow> scheduler_action s = choose_new_thread) \<and> (ct_idle s \<longrightarrow> a = idle_context s0_internal)\<rbrace>
 2. \<And>a b aa ba e bb r P. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba; idle_equiv s0_internal ba; aa = a; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (cur_domain s)\<rbrace> kernel_entry_if e a \<lbrace>\<lambda>r s. P (cur_domain s)\<rbrace>
 3. \<And>a b aa ba e bb r. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); r = Inr (); \<not> bb; invs ba; idle_equiv s0_internal ba; aa = a; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> ?P169 a b aa ba e bb r (current_aag b) b
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>a b ba e bb. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); \<not> bb; invs ba; idle_equiv s0_internal ba; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> (ct_active b \<or> ct_idle b) \<and> (ct_active b \<longrightarrow> is_subject (current_aag b) (cur_thread b)) \<and> schact_is_rct b \<and> (ct_active b \<longrightarrow> is_subject (current_aag b) (cur_thread b))
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba e bb. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); \<not> bb; invs ba; idle_equiv s0_internal ba; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> (ct_active b \<longrightarrow> is_subject (current_aag b) (cur_thread b)) \<and> schact_is_rct b \<and> (ct_active b \<longrightarrow> is_subject (current_aag b) (cur_thread b))
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba e bb. \<lbrakk>invs b; step_restrict ((a, ba), KernelSchedule (e = Interrupt)); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv (current_aag b) s0_internal b; domain_sep_inv False s0_internal b; pas_refined (current_aag b) b; guarded_pas_domain (current_aag b) b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelEntry e) a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context s0_internal; e \<noteq> Interrupt \<longrightarrow> ct_running b; s = ((a, b), KernelEntry e); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; t = ((a, ba), KernelSchedule (e = Interrupt)); \<not> bb; invs ba; idle_equiv s0_internal ba; det_inv (KernelSchedule (e = Interrupt)) (cur_context ba) ba\<rbrakk> \<Longrightarrow> ct_active b \<longrightarrow> is_subject (current_aag b) (cur_thread b)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv (current_aag (internal_state_if s)) s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined (current_aag (internal_state_if s)) (internal_state_if s); guarded_pas_domain (current_aag (internal_state_if s)) (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv (current_aag (internal_state_if t)) s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined (current_aag (internal_state_if t)) (internal_state_if t) \<and> guarded_pas_domain (current_aag (internal_state_if t)) (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b. \<lbrakk>invs b; step_restrict t; valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted) \<and> (\<exists>aa ba. t = ((aa, ba), KernelSchedule True) \<and> ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict t; valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); ((a, b), (), aa, ba) \<in> kernel_handle_preemption_if\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b)\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule True) (cur_context ba) ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b); idle_equiv s0_internal ba \<and> invs ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule True) (cur_context ba) ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b)\<rbrakk> \<Longrightarrow> idle_equiv s0_internal ba \<and> invs ba
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b)\<rbrakk> \<Longrightarrow> idle_equiv s0_internal ba \<and> invs ba
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b); idle_equiv s0_internal ba \<and> invs ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule True) (cur_context ba) ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (10 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True)\<rbrakk> \<Longrightarrow> \<lbrace>?P251 a b aa ba\<rbrace> handle_preemption_if a \<lbrace>\<lambda>a b. idle_equiv s0_internal b \<and> invs b\<rbrace>
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True)\<rbrakk> \<Longrightarrow> ?P251 a b aa ba b
 3. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b); idle_equiv s0_internal ba \<and> invs ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule True) (cur_context ba) ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 10. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b); idle_equiv s0_internal ba \<and> invs ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule True) (cur_context ba) ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context s0_internal; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); (aa, ba) \<in> fst (handle_preemption_if a b); idle_equiv s0_internal ba; invs ba\<rbrakk> \<Longrightarrow> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelSchedule True) (cur_context ba) ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context s0_internal)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context s0_internal; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); idle_equiv s0_internal ba; invs ba\<rbrakk> \<Longrightarrow> \<lbrace>?P263 a b aa ba\<rbrace> handle_preemption_if a \<lbrace>\<lambda>a b. valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> domain_sep_inv False s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> valid_domain_list b \<and> valid_vspace_objs_if b \<and> det_inv (KernelSchedule True) (cur_context b) b \<and> (domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread) \<and> (ct_idle b \<longrightarrow> a = idle_context s0_internal)\<rbrace>
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context s0_internal; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); idle_equiv s0_internal ba; invs ba\<rbrakk> \<Longrightarrow> ?P263 a b aa ba b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (9 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context s0_internal; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); idle_equiv s0_internal ba; invs ba\<rbrakk> \<Longrightarrow> \<lbrace>?P263 a b aa ba\<rbrace> handle_preemption_if a \<lbrace>\<lambda>rv s. valid_list s \<and> valid_sched s \<and> only_timer_irq_inv timer_irq s0_internal s \<and> silc_inv initial_aag s0_internal s \<and> domain_sep_inv False s0_internal s \<and> pas_refined initial_aag s \<and> guarded_pas_domain initial_aag s \<and> valid_domain_list s \<and> valid_vspace_objs_if s \<and> det_inv (KernelSchedule True) (cur_context s) s \<and> (domain_time s = 0 \<longrightarrow> scheduler_action s = choose_new_thread) \<and> (ct_idle s \<longrightarrow> a = idle_context s0_internal)\<rbrace>
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context s0_internal; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); idle_equiv s0_internal ba; invs ba\<rbrakk> \<Longrightarrow> ?P263 a b aa ba b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 9. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), KernelSchedule True); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelPreempted (cur_context b) b; 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context s0_internal; s = ((a, b), KernelPreempted); t = ((aa, ba), KernelSchedule True); idle_equiv s0_internal ba; invs ba\<rbrakk> \<Longrightarrow> valid_list b \<and> (valid_sched and invs) b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> domain_sep_inv False s0_internal b \<and> (pas_refined initial_aag and pspace_aligned and valid_vspace_objs and valid_arch_state) b \<and> guarded_pas_domain initial_aag b \<and> valid_domain_list b \<and> valid_vspace_objs_if b \<and> (einvs and (\<lambda>s. det_inv KernelPreempted (cur_context s) s)) b \<and> 0 < domain_time b \<and> (invs and (\<lambda>s. ct_idle s \<longrightarrow> a = idle_context s0_internal)) b
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. (\<exists>ba. s = ((a, b), KernelSchedule ba)) \<and> (\<exists>aa ba. t = ((aa, ba), KernelExit) \<and> ((a, b), (), aa, ba) \<in> kernel_schedule_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (7 subgoals):
 1. \<And>a b ba aa bb. \<lbrakk>invs b; step_restrict ((aa, bb), KernelExit); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelSchedule ba) (cur_context b) b; \<not> ba \<longrightarrow> 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelSchedule ba); t = ((aa, bb), KernelExit); (aa, bb) \<in> fst (schedule_if a b)\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv KernelExit (cur_context bb) bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba aa bb. \<lbrakk>invs b; step_restrict ((aa, bb), KernelExit); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelSchedule ba) (cur_context b) b; \<not> ba \<longrightarrow> 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelSchedule ba); t = ((aa, bb), KernelExit)\<rbrakk> \<Longrightarrow> \<lbrace>?P418 a b ba aa bb\<rbrace> schedule_if a \<lbrace>\<lambda>a b. invs b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> domain_sep_inv False s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> valid_domain_list b \<and> valid_vspace_objs_if b \<and> det_inv KernelExit (cur_context b) b \<and> 0 < domain_time b \<and> (domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread) \<and> (ct_running b \<or> ct_idle b) \<and> scheduler_action b = resume_cur_thread\<rbrace>
 2. \<And>a b ba aa bb. \<lbrakk>invs b; step_restrict ((aa, bb), KernelExit); valid_list b; valid_sched b; only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv (KernelSchedule ba) (cur_context b) b; \<not> ba \<longrightarrow> 0 < domain_time b; domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), KernelSchedule ba); t = ((aa, bb), KernelExit)\<rbrakk> \<Longrightarrow> ?P418 a b ba aa bb b
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 8. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), KernelExit) \<and> (\<exists>aa ba m. t = ((aa, ba), m) \<and> ((a, b), m, aa, ba) \<in> kernel_exit_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelExit (cur_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; s = ((a, b), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a b); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InUserMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> scheduler_action ba = resume_cur_thread) \<and> (\<not> ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelExit (cur_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; s = ((a, b), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a b); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; b = ba\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InUserMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> scheduler_action ba = resume_cur_thread) \<and> (\<not> ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (7 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelExit (cur_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; s = ((a, b), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a b); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; b = ba\<rbrakk> \<Longrightarrow> (einvs and (\<lambda>s. det_inv KernelExit (cur_context s) s) and (\<lambda>s. ct_running s \<or> ct_idle s)) b
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelExit (cur_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; s = ((a, b), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a b); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; b = ba; if ct_running ba then det_inv InUserMode aa ba else det_inv InIdleMode aa ba\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InUserMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> scheduler_action ba = resume_cur_thread) \<and> (\<not> ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv KernelExit (cur_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; s = ((a, b), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a b); ct_running b \<or> ct_idle b; scheduler_action b = resume_cur_thread; b = ba; if ct_running ba then det_inv InUserMode aa ba else det_inv InIdleMode aa ba\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InUserMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> scheduler_action ba = resume_cur_thread) \<and> (\<not> ct_running ba \<longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a aa ba. \<lbrakk>invs ba; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list ba; valid_sched_2 (ready_queues ba) (ekheap ba) resume_cur_thread (cur_domain ba) (kheap ba) (cur_thread ba) (idle_thread ba); only_timer_irq_inv timer_irq s0_internal ba; silc_inv initial_aag s0_internal ba; domain_sep_inv False s0_internal ba; pas_refined initial_aag ba; guarded_pas_domain initial_aag ba; idle_equiv s0_internal ba; valid_domain_list ba; valid_vspace_objs_if ba; det_inv KernelExit (cur_context ba) ba; 0 < domain_time ba; domain_time ba \<noteq> 0; s = ((a, ba), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a ba); ct_running ba \<or> ct_idle ba; scheduler_action ba = resume_cur_thread; if ct_running ba then det_inv InUserMode aa ba else det_inv InIdleMode aa ba\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (\<not> ct_running ba \<longrightarrow> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (7 subgoals):
 1. \<And>a aa ba. \<lbrakk>invs ba; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list ba; valid_sched_2 (ready_queues ba) (ekheap ba) resume_cur_thread (cur_domain ba) (kheap ba) (cur_thread ba) (idle_thread ba); only_timer_irq_inv timer_irq s0_internal ba; silc_inv initial_aag s0_internal ba; domain_sep_inv False s0_internal ba; pas_refined initial_aag ba; guarded_pas_domain initial_aag ba; idle_equiv s0_internal ba; valid_domain_list ba; valid_vspace_objs_if ba; det_inv KernelExit (cur_context ba) ba; 0 < domain_time ba; domain_time ba \<noteq> 0; s = ((a, ba), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a ba); scheduler_action ba = resume_cur_thread; if ct_running ba then det_inv InUserMode aa ba else det_inv InIdleMode aa ba; ct_running ba\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (\<not> ct_running ba \<longrightarrow> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba)
 2. \<And>a aa ba. \<lbrakk>invs ba; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list ba; valid_sched_2 (ready_queues ba) (ekheap ba) resume_cur_thread (cur_domain ba) (kheap ba) (cur_thread ba) (idle_thread ba); only_timer_irq_inv timer_irq s0_internal ba; silc_inv initial_aag s0_internal ba; domain_sep_inv False s0_internal ba; pas_refined initial_aag ba; guarded_pas_domain initial_aag ba; idle_equiv s0_internal ba; valid_domain_list ba; valid_vspace_objs_if ba; det_inv KernelExit (cur_context ba) ba; 0 < domain_time ba; domain_time ba \<noteq> 0; s = ((a, ba), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a ba); scheduler_action ba = resume_cur_thread; if ct_running ba then det_inv InUserMode aa ba else det_inv InIdleMode aa ba; ct_idle ba\<rbrakk> \<Longrightarrow> (ct_running ba \<longrightarrow> ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (\<not> ct_running ba \<longrightarrow> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a aa ba. \<lbrakk>invs ba; step_restrict ((aa, ba), if ct_running ba then InUserMode else InIdleMode); valid_list ba; valid_sched_2 (ready_queues ba) (ekheap ba) resume_cur_thread (cur_domain ba) (kheap ba) (cur_thread ba) (idle_thread ba); only_timer_irq_inv timer_irq s0_internal ba; silc_inv initial_aag s0_internal ba; domain_sep_inv False s0_internal ba; pas_refined initial_aag ba; guarded_pas_domain initial_aag ba; idle_equiv s0_internal ba; valid_domain_list ba; valid_vspace_objs_if ba; det_inv KernelExit (cur_context ba) ba; 0 < domain_time ba; domain_time ba \<noteq> 0; s = ((a, ba), KernelExit); t = ((aa, ba), if ct_running ba then InUserMode else InIdleMode); (aa, ba) \<in> fst (kernel_exit_if a ba); scheduler_action ba = resume_cur_thread; if ct_running ba then det_inv InUserMode aa ba else det_inv InIdleMode aa ba; ct_idle ba\<rbrakk> \<Longrightarrow> aa = idle_context ba
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb e. t = ((ab, bb), KernelEntry e) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), Some e, ab, bb) \<in> do_user_op_A_if utf \<and> e \<noteq> Interrupt)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode aa and ct_running) ba
 2. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some e, ab) of None \<Rightarrow> det_inv InUserMode (snd (Some e, ab)) | Some ea \<Rightarrow> det_inv (KernelEntry ea) (snd (Some e, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (7 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode a and ct_running) b
 2. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, aa) of None \<Rightarrow> det_inv InUserMode (snd (None, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, aa))) ba\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode aa and ct_running) ba
 3. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some e, ab) of None \<Rightarrow> det_inv InUserMode (snd (Some e, ab)) | Some ea \<Rightarrow> det_inv (KernelEntry ea) (snd (Some e, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, aa) of None \<Rightarrow> det_inv InUserMode (snd (None, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, aa))) ba\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode aa and ct_running) ba
 2. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some e, ab) of None \<Rightarrow> det_inv InUserMode (snd (Some e, ab)) | Some ea \<Rightarrow> det_inv (KernelEntry ea) (snd (Some e, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode aa ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> ct_running ba
 2. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some e, ab) of None \<Rightarrow> det_inv InUserMode (snd (Some e, ab)) | Some ea \<Rightarrow> det_inv (KernelEntry ea) (snd (Some e, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode aa ba\<rbrakk> \<Longrightarrow> invs (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> ct_running (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)
 2. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some e, ab) of None \<Rightarrow> det_inv InUserMode (snd (Some e, ab)) | Some ea \<Rightarrow> det_inv (KernelEntry ea) (snd (Some e, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some e, ab) of None \<Rightarrow> det_inv InUserMode (snd (Some e, ab)) | Some ea \<Rightarrow> det_inv (KernelEntry ea) (snd (Some e, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv (KernelEntry e) ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((Some e, ab), bb) \<in> fst (do_user_op_if utf aa ba); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> (ct_running bb \<or> ct_idle bb) \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> \<lbrace>?P829 a b aa ba ab bb e (irq_at (irq_state_of_state b + 1) (irq_masks_of_state b), a) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)\<rbrace> do_user_op_if utf aa \<lbrace>\<lambda>a b. invs b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> domain_sep_inv False s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> valid_domain_list b \<and> valid_vspace_objs_if b \<and> 0 < domain_time b \<and> (domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread) \<and> (ct_idle b \<longrightarrow> ab = idle_context b) \<and> ct_running b \<and> (ct_running b \<or> ct_idle b) \<and> scheduler_action b = resume_cur_thread\<rbrace>
 2. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> ?P829 a b aa ba ab bb e (None, aa) ba ba
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (7 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> \<lbrace>?P829 a b aa ba ab bb e (irq_at (irq_state_of_state b + 1) (irq_masks_of_state b), a) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)\<rbrace> do_user_op_if utf aa \<lbrace>\<lambda>a. invs and ct_running and (\<lambda>b. valid_vspace_objs_if b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> domain_sep_inv False s0_internal b \<and> valid_domain_list b \<and> 0 < domain_time b \<and> scheduler_action b = resume_cur_thread)\<rbrace>
 2. \<And>a b aa ba ab bb e rv sa. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb; (invs and ct_running and (\<lambda>b. valid_vspace_objs_if b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> domain_sep_inv False s0_internal b \<and> valid_domain_list b \<and> 0 < domain_time b \<and> scheduler_action b = resume_cur_thread)) sa\<rbrakk> \<Longrightarrow> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> only_timer_irq_inv timer_irq s0_internal sa \<and> silc_inv initial_aag s0_internal sa \<and> domain_sep_inv False s0_internal sa \<and> pas_refined initial_aag sa \<and> guarded_pas_domain initial_aag sa \<and> idle_equiv s0_internal sa \<and> valid_domain_list sa \<and> valid_vspace_objs_if sa \<and> 0 < domain_time sa \<and> (domain_time sa = 0 \<longrightarrow> scheduler_action sa = choose_new_thread) \<and> (ct_idle sa \<longrightarrow> ab = idle_context sa) \<and> ct_running sa \<and> (ct_running sa \<or> ct_idle sa) \<and> scheduler_action sa = resume_cur_thread
 3. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> ?P829 a b aa ba ab bb e (None, aa) ba ba
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 7. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); ((None, aa), ba) \<in> fst (check_active_irq_if a b); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> (invs and ct_running) ba \<and> valid_vspace_objs_if ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> (idle_equiv s0_internal and invs) ba \<and> domain_sep_inv False s0_internal ba \<and> valid_domain_list ba \<and> 0 < domain_time ba \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb e. \<lbrakk>invs b; step_restrict ((ab, bb), KernelEntry e); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), KernelEntry e); e \<noteq> Interrupt; ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry e) ab bb\<rbrakk> \<Longrightarrow> (invs and ct_running) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> only_timer_irq_inv timer_irq s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> silc_inv initial_aag s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> pas_refined initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> guarded_pas_domain initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> (idle_equiv s0_internal and invs) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> domain_sep_inv False s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_domain_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> 0 < domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba ab bb. t = ((ab, bb), InUserMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if \<and> ((aa, ba), None, ab, bb) \<in> do_user_op_A_if utf)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode aa and ct_running) ba
 2. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, ab) of None \<Rightarrow> det_inv InUserMode (snd (None, ab)) | Some e \<Rightarrow> det_inv (KernelEntry e) (snd (None, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode a and ct_running) b
 2. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, aa) of None \<Rightarrow> det_inv InUserMode (snd (None, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, aa))) ba\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode aa and ct_running) ba
 3. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, ab) of None \<Rightarrow> det_inv InUserMode (snd (None, ab)) | Some e \<Rightarrow> det_inv (KernelEntry e) (snd (None, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, aa) of None \<Rightarrow> det_inv InUserMode (snd (None, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, aa))) ba\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode aa and ct_running) ba
 2. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, ab) of None \<Rightarrow> det_inv InUserMode (snd (None, ab)) | Some e \<Rightarrow> det_inv (KernelEntry e) (snd (None, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode aa ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> ct_running ba
 2. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, ab) of None \<Rightarrow> det_inv InUserMode (snd (None, ab)) | Some e \<Rightarrow> det_inv (KernelEntry e) (snd (None, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode aa ba\<rbrakk> \<Longrightarrow> invs (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> ct_running (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)
 2. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, ab) of None \<Rightarrow> det_inv InUserMode (snd (None, ab)) | Some e \<Rightarrow> det_inv (KernelEntry e) (snd (None, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; (case fst (None, ab) of None \<Rightarrow> det_inv InUserMode (snd (None, ab)) | Some e \<Rightarrow> det_inv (KernelEntry e) (snd (None, ab))) bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> det_inv InUserMode ab bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ((None, ab), bb) \<in> fst (do_user_op_if utf aa ba); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> invs bb \<and> valid_list bb \<and> valid_sched bb \<and> only_timer_irq_inv timer_irq s0_internal bb \<and> silc_inv initial_aag s0_internal bb \<and> domain_sep_inv False s0_internal bb \<and> pas_refined initial_aag bb \<and> guarded_pas_domain initial_aag bb \<and> idle_equiv s0_internal bb \<and> valid_domain_list bb \<and> valid_vspace_objs_if bb \<and> 0 < domain_time bb \<and> (domain_time bb = 0 \<longrightarrow> scheduler_action bb = choose_new_thread) \<and> (ct_idle bb \<longrightarrow> ab = idle_context bb) \<and> ct_running bb \<and> scheduler_action bb = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> \<lbrace>?P998 a b aa ba ab bb (irq_at (irq_state_of_state b + 1) (irq_masks_of_state b), a) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)\<rbrace> do_user_op_if utf aa \<lbrace>\<lambda>a b. invs b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> domain_sep_inv False s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> valid_domain_list b \<and> valid_vspace_objs_if b \<and> 0 < domain_time b \<and> (domain_time b = 0 \<longrightarrow> scheduler_action b = choose_new_thread) \<and> (ct_idle b \<longrightarrow> ab = idle_context b) \<and> ct_running b \<and> scheduler_action b = resume_cur_thread\<rbrace>
 2. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> ?P998 a b aa ba ab bb (None, aa) ba ba
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> \<lbrace>?P998 a b aa ba ab bb (irq_at (irq_state_of_state b + 1) (irq_masks_of_state b), a) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)\<rbrace> do_user_op_if utf aa \<lbrace>\<lambda>a. invs and ct_running and (\<lambda>b. valid_vspace_objs_if b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> domain_sep_inv False s0_internal b \<and> valid_domain_list b \<and> 0 < domain_time b \<and> scheduler_action b = resume_cur_thread)\<rbrace>
 2. \<And>a b aa ba ab bb rv sa. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb; (invs and ct_running and (\<lambda>b. valid_vspace_objs_if b \<and> valid_list b \<and> valid_sched b \<and> only_timer_irq_inv timer_irq s0_internal b \<and> silc_inv initial_aag s0_internal b \<and> pas_refined initial_aag b \<and> guarded_pas_domain initial_aag b \<and> idle_equiv s0_internal b \<and> domain_sep_inv False s0_internal b \<and> valid_domain_list b \<and> 0 < domain_time b \<and> scheduler_action b = resume_cur_thread)) sa\<rbrakk> \<Longrightarrow> invs sa \<and> valid_list sa \<and> valid_sched sa \<and> only_timer_irq_inv timer_irq s0_internal sa \<and> silc_inv initial_aag s0_internal sa \<and> domain_sep_inv False s0_internal sa \<and> pas_refined initial_aag sa \<and> guarded_pas_domain initial_aag sa \<and> idle_equiv s0_internal sa \<and> valid_domain_list sa \<and> valid_vspace_objs_if sa \<and> 0 < domain_time sa \<and> (domain_time sa = 0 \<longrightarrow> scheduler_action sa = choose_new_thread) \<and> (ct_idle sa \<longrightarrow> ab = idle_context sa) \<and> ct_running sa \<and> scheduler_action sa = resume_cur_thread
 3. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> ?P998 a b aa ba ab bb (None, aa) ba ba
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 5. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 6. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ((None, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> (invs and ct_running) ba \<and> valid_vspace_objs_if ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> (idle_equiv s0_internal and invs) ba \<and> domain_sep_inv False s0_internal ba \<and> valid_domain_list ba \<and> 0 < domain_time ba \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba ab bb. \<lbrakk>invs b; step_restrict ((ab, bb), InUserMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((ab, bb), InUserMode); ct_running b; scheduler_action b = resume_cur_thread; det_inv InUserMode ab bb\<rbrakk> \<Longrightarrow> (invs and ct_running) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> only_timer_irq_inv timer_irq s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> silc_inv initial_aag s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> pas_refined initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> guarded_pas_domain initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> (idle_equiv s0_internal and invs) (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> domain_sep_inv False s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_domain_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> 0 < domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InUserMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (einvs and det_inv InUserMode a and ct_running) b
 2. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some i, aa) of None \<Rightarrow> det_inv InUserMode (snd (Some i, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (Some i, aa))) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 4. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread; (case fst (Some i, aa) of None \<Rightarrow> det_inv InUserMode (snd (Some i, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (Some i, aa))) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if a b); ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry Interrupt) aa ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InUserMode a b; 0 < domain_time b; domain_time b \<noteq> 0; ct_idle b \<longrightarrow> a = idle_context b; s = ((a, b), InUserMode); t = ((aa, ba), KernelEntry Interrupt); ct_running b; scheduler_action b = resume_cur_thread; det_inv (KernelEntry Interrupt) aa ba\<rbrakk> \<Longrightarrow> invs (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> only_timer_irq_inv timer_irq s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> silc_inv initial_aag s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> domain_sep_inv False s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> pas_refined initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> guarded_pas_domain initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> idle_equiv s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_domain_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> 0 < domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> (domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = 0 \<longrightarrow> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = choose_new_thread) \<and> (ct_idle (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<longrightarrow> aa = idle_context (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)) \<and> (ct_running (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<or> ct_idle (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)) \<and> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), KernelEntry Interrupt) \<and> (\<exists>i. ((a, b), Some i, aa, ba) \<in> check_active_irq_A_if))\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True)
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; snd (Some i, aa) = idle_context b\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; snd (Some i, aa) = idle_context b\<rbrakk> \<Longrightarrow> (einvs and det_inv InIdleMode (idle_context b) and ct_idle) b
 2. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; snd (Some i, aa) = idle_context b; (case fst (Some i, aa) of None \<Rightarrow> det_inv InIdleMode (snd (Some i, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (Some i, aa))) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 3. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((aa, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), KernelEntry Interrupt); ((Some i, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; snd (Some i, aa) = idle_context b; (case fst (Some i, aa) of None \<Rightarrow> det_inv InIdleMode (snd (Some i, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (Some i, aa))) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv (KernelEntry Interrupt) aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((idle_context b, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((idle_context b, ba), KernelEntry Interrupt); ((Some i, idle_context b), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; aa = idle_context b; det_inv (KernelEntry Interrupt) (idle_context b) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> idle_context b = idle_context ba) \<and> (ct_running ba \<or> ct_idle ba) \<and> scheduler_action ba = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba i. \<lbrakk>invs b; step_restrict ((idle_context b, ba), KernelEntry Interrupt); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((idle_context b, ba), KernelEntry Interrupt); ct_idle b; scheduler_action b = resume_cur_thread; aa = idle_context b; det_inv (KernelEntry Interrupt) (idle_context b) ba\<rbrakk> \<Longrightarrow> invs (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> only_timer_irq_inv timer_irq s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> silc_inv initial_aag s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> domain_sep_inv False s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> pas_refined initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> guarded_pas_domain initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> idle_equiv s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_domain_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> 0 < domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> (domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = 0 \<longrightarrow> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = choose_new_thread) \<and> (ct_idle (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<longrightarrow> idle_context b = idle_context (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)) \<and> (ct_running (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<or> ct_idle (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)) \<and> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = resume_cur_thread
 2. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs (internal_state_if s); step_restrict t; valid_list (internal_state_if s); valid_sched (internal_state_if s); only_timer_irq_inv timer_irq s0_internal (internal_state_if s); silc_inv initial_aag s0_internal (internal_state_if s); domain_sep_inv False s0_internal (internal_state_if s); pas_refined initial_aag (internal_state_if s); guarded_pas_domain initial_aag (internal_state_if s); idle_equiv s0_internal (internal_state_if s); valid_domain_list (internal_state_if s); valid_vspace_objs_if (internal_state_if s); det_inv (sys_mode_of s) (case sys_mode_of s of KernelPreempted \<Rightarrow> cur_context (internal_state_if s) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if s) | KernelExit \<Rightarrow> cur_context (internal_state_if s) | _ \<Rightarrow> user_context_of s) (internal_state_if s); snd s \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if s); domain_time (internal_state_if s) = 0 \<longrightarrow> scheduler_action (internal_state_if s) = choose_new_thread; snd s \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if s) \<longrightarrow> user_context_of s = idle_context (internal_state_if s); case snd s of InUserMode \<Rightarrow> ct_running (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if s) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if s)) \<and> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if s) \<or> ct_idle (internal_state_if s)) \<and> scheduler_action (internal_state_if s) = resume_cur_thread | _ \<Rightarrow> True; \<exists>a b. s = ((a, b), InIdleMode) \<and> (\<exists>aa ba. t = ((aa, ba), InIdleMode) \<and> ((a, b), None, aa, ba) \<in> check_active_irq_A_if)\<rbrakk> \<Longrightarrow> invs (internal_state_if t) \<and> valid_list (internal_state_if t) \<and> valid_sched (internal_state_if t) \<and> only_timer_irq_inv timer_irq s0_internal (internal_state_if t) \<and> silc_inv initial_aag s0_internal (internal_state_if t) \<and> domain_sep_inv False s0_internal (internal_state_if t) \<and> pas_refined initial_aag (internal_state_if t) \<and> guarded_pas_domain initial_aag (internal_state_if t) \<and> idle_equiv s0_internal (internal_state_if t) \<and> valid_domain_list (internal_state_if t) \<and> valid_vspace_objs_if (internal_state_if t) \<and> det_inv (sys_mode_of t) (case sys_mode_of t of KernelPreempted \<Rightarrow> cur_context (internal_state_if t) | KernelSchedule bool \<Rightarrow> cur_context (internal_state_if t) | KernelExit \<Rightarrow> cur_context (internal_state_if t) | _ \<Rightarrow> user_context_of t) (internal_state_if t) \<and> (snd t \<noteq> KernelSchedule True \<longrightarrow> 0 < domain_time (internal_state_if t)) \<and> (domain_time (internal_state_if t) = 0 \<longrightarrow> scheduler_action (internal_state_if t) = choose_new_thread) \<and> (snd t \<noteq> KernelExit \<longrightarrow> ct_idle (internal_state_if t) \<longrightarrow> user_context_of t = idle_context (internal_state_if t)) \<and> (case snd t of InUserMode \<Rightarrow> ct_running (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | InIdleMode \<Rightarrow> ct_idle (internal_state_if t) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelEntry e \<Rightarrow> (e \<noteq> Interrupt \<longrightarrow> ct_running (internal_state_if t)) \<and> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | KernelExit \<Rightarrow> (ct_running (internal_state_if t) \<or> ct_idle (internal_state_if t)) \<and> scheduler_action (internal_state_if t) = resume_cur_thread | _ \<Rightarrow> True) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread\<rbrakk> \<Longrightarrow> (einvs and det_inv InIdleMode (idle_context b) and ct_idle) b
 2. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; (case fst (None, aa) of None \<Rightarrow> det_inv InIdleMode (snd (None, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, aa))) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; (case fst (None, aa) of None \<Rightarrow> det_inv InIdleMode (snd (None, aa)) | Some irq \<Rightarrow> det_inv (KernelEntry Interrupt) (snd (None, aa))) ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> det_inv InIdleMode aa ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; det_inv InIdleMode aa ba\<rbrakk> \<Longrightarrow> invs ba \<and> valid_list ba \<and> valid_sched ba \<and> only_timer_irq_inv timer_irq s0_internal ba \<and> silc_inv initial_aag s0_internal ba \<and> domain_sep_inv False s0_internal ba \<and> pas_refined initial_aag ba \<and> guarded_pas_domain initial_aag ba \<and> idle_equiv s0_internal ba \<and> valid_domain_list ba \<and> valid_vspace_objs_if ba \<and> 0 < domain_time ba \<and> (domain_time ba = 0 \<longrightarrow> scheduler_action ba = choose_new_thread) \<and> (ct_idle ba \<longrightarrow> aa = idle_context ba) \<and> ct_idle ba \<and> scheduler_action ba = resume_cur_thread proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); ct_idle b; scheduler_action b = resume_cur_thread; det_inv InIdleMode aa ba\<rbrakk> \<Longrightarrow> invs (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_sched (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> only_timer_irq_inv timer_irq s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> silc_inv initial_aag s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> domain_sep_inv False s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> pas_refined initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> guarded_pas_domain initial_aag (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> idle_equiv s0_internal (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_domain_list (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> valid_vspace_objs_if (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> 0 < domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> (domain_time (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = 0 \<longrightarrow> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = choose_new_thread) \<and> (ct_idle (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<longrightarrow> aa = idle_context (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>)) \<and> ct_idle (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) \<and> scheduler_action (b\<lparr>machine_state := machine_state b\<lparr>irq_state := irq_state_of_state b + 1\<rparr>\<rparr>) = resume_cur_thread proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((aa, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((aa, ba), InIdleMode); ((None, aa), ba) \<in> fst (check_active_irq_if (idle_context b) b); st_tcb_at idle (cur_thread b) b; scheduler_action b = resume_cur_thread; det_inv InIdleMode aa ba\<rbrakk> \<Longrightarrow> aa = idle_context (b\<lparr>machine_state := machine_state b\<lparr>irq_state := Suc (irq_state_of_state b)\<rparr>\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>invs b; step_restrict ((idle_context b, ba), InIdleMode); valid_list b; valid_sched_2 (ready_queues b) (ekheap b) resume_cur_thread (cur_domain b) (kheap b) (cur_thread b) (idle_thread b); only_timer_irq_inv timer_irq s0_internal b; silc_inv initial_aag s0_internal b; domain_sep_inv False s0_internal b; pas_refined initial_aag b; guarded_pas_domain initial_aag b; idle_equiv s0_internal b; valid_domain_list b; valid_vspace_objs_if b; det_inv InIdleMode (idle_context b) b; 0 < domain_time b; domain_time b \<noteq> 0; a = idle_context b; s = ((idle_context b, b), InIdleMode); t = ((idle_context b, ba), InIdleMode); ((None, idle_context b), ba) \<in> fst (check_active_irq_if (idle_context b) b); st_tcb_at idle (cur_thread b) b; scheduler_action b = resume_cur_thread; det_inv InIdleMode (idle_context b) ba; aa = idle_context b\<rbrakk> \<Longrightarrow> idle_context b = idle_context (b\<lparr>machine_state := machine_state b\<lparr>irq_state := Suc (irq_state_of_state b)\<rparr>\<rparr>) proof (prove)
goal:
No subgoals!