theory ADT_IF

lemma ADT_A_if_Step_measure_if':
  "\<lbrakk> (s,s') \<in> data_type.Step (ADT_A_if utf) x; invs_if s; measuref_if y s > 0 \<rbrakk>
     \<Longrightarrow> measuref_if y s' < measuref_if y s \<and>
         (\<not> interrupted_modes (snd s)
          \<longrightarrow> \<not> interrupted_modes (snd s')
              \<longrightarrow> next_irq_state_of_state (internal_state_if s') =
                  next_irq_state_of_state (internal_state_if s))" apply (frule invs_if_irq_is_recurring) apply (case_tac s, clarsimp) apply (rename_tac uc i_s mode) apply (case_tac mode) apply (simp_all add: rah_simp system.Step_def execution_def steps_def ADT_A_if_def
                            global_automaton_if_def check_active_irq_A_if_def do_user_op_A_if_def
                            check_active_irq_if_def in_monad measuref_if_def
              | safe | split if_splits)+ apply (frule getActiveIRQ_None) apply (erule use_valid[OF _ do_user_op_if_irq_measure_if]) apply (erule use_valid[OF _ dmo_getActiveIRQ_wp]) apply (clarsimp simp: irq_measure_if_def Let_def) apply (simp add: next_irq_state_Suc recurring_next_irq_state_dom) apply (blast intro: rah4[OF next_irq_state_less]) apply (frule getActiveIRQ_None) apply (erule use_valid[OF _ do_user_op_if_next_irq_state_of_state]) apply (erule use_valid[OF _ dmo_getActiveIRQ_wp]) apply (simp add: next_irq_state_Suc recurring_next_irq_state_dom) apply (clarsimp split: if_splits) apply (frule getActiveIRQ_None) apply (erule use_valid[OF _ do_user_op_if_irq_measure_if]) apply (erule use_valid[OF _ dmo_getActiveIRQ_wp]) apply (clarsimp simp: irq_measure_if_def Let_def) apply (simp add: next_irq_state_Suc recurring_next_irq_state_dom) apply (fastforce dest: next_irq_state_less) apply (frule getActiveIRQ_None) apply (erule use_valid[OF _ do_user_op_if_next_irq_state_of_state]) apply (erule use_valid[OF _ dmo_getActiveIRQ_wp]) apply (simp add: next_irq_state_Suc recurring_next_irq_state_dom) apply (clarsimp split: if_splits)+ apply (frule getActiveIRQ_None) apply (erule use_valid[OF _ dmo_getActiveIRQ_wp]) apply (clarsimp simp: irq_measure_if_def Let_def) apply (simp add: next_irq_state_Suc recurring_next_irq_state_dom) apply (fastforce dest: next_irq_state_less) apply (frule getActiveIRQ_None) apply (erule use_valid[OF _ dmo_getActiveIRQ_wp]) apply (simp add: next_irq_state_Suc recurring_next_irq_state_dom) apply (clarsimp split: if_splits) apply (clarsimp simp: kernel_call_A_if_def kernel_entry_if_def in_monad) apply (clarsimp split: if_splits) apply (rule Suc_le_lessD) apply simp apply (simp add: kernel_call_A_if_def) apply (elim exE conjE) apply (rule_tac event=x3 in kernel_entry_if_irq_measure) apply ((simp add: invs_if_def Invs_def only_timer_irq_inv_def
                             | elim conjE | assumption)+)[4] apply (simp) apply (simp add: kernel_call_A_if_def | elim conjE exE)+ apply (erule kernel_entry_if_next_irq_state_of_state) apply ((simp add: invs_if_def Invs_def only_timer_irq_inv_def
                           | elim conjE | assumption)+)[4] apply (clarsimp split: if_splits) apply (rule Suc_le_lessD) apply (simp add: kernel_schedule_if_def) apply (blast intro: schedule_if_irq_measure_if) apply (simp add: kernel_schedule_if_def) apply (blast intro: schedule_if_next_irq_state_of_state) apply (simp add: kernel_schedule_if_def) apply (blast intro: schedule_if_next_irq_state_of_state) apply (clarsimp simp: kernel_exit_A_if_def split: if_splits) apply (clarsimp simp: kernel_exit_A_if_def) apply ((erule use_valid, wp | simp)+)[1] apply (clarsimp split: if_splits) apply (clarsimp simp: kernel_exit_A_if_def split: if_splits) apply (clarsimp simp: kernel_exit_A_if_def) apply ((erule use_valid, wp | simp)+)[1] apply (clarsimp split: if_splits)+ apply (clarsimp split: sys_mode.splits | safe)+ apply (clarsimp simp: irq_measure_if_def kernel_exit_A_if_def split: if_splits) apply (drule state_unchanged[OF kernel_exit_if_inv], simp) apply (clarsimp simp: irq_measure_if_def kernel_exit_A_if_def split: if_splits) apply (drule state_unchanged[OF kernel_exit_if_inv], simp) apply (clarsimp simp: kernel_exit_A_if_def split: if_splits) apply (clarsimp simp: kernel_exit_A_if_def split: if_splits) apply (clarsimp simp: kernel_exit_A_if_def) apply ((erule use_valid, wp | simp)+)[1] apply (clarsimp simp: kernel_exit_A_if_def split: if_splits) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s, s') \<in> Step (ADT_A_if utf) x; invs_if s; 0 < measuref_if y s\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y s \<and> (\<not> interrupted_modes (snd s) \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state (internal_state_if s)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s, s') \<in> Step (ADT_A_if utf) x; invs_if s; 0 < measuref_if y s; irq_is_recurring timer_irq (internal_state_if s)\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y s \<and> (\<not> interrupted_modes (snd s) \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state (internal_state_if s)) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba. \<lbrakk>(((a, b), ba), s') \<in> Step (ADT_A_if utf) (); invs_if ((a, b), ba); 0 < measuref_if y ((a, b), ba); irq_is_recurring timer_irq b; s = ((a, b), ba)\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((a, b), ba) \<and> (\<not> interrupted_modes ba \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state b) proof (prove)
goal (1 subgoal):
 1. \<And>uc i_s mode. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode)\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s) proof (prove)
goal (6 subgoals):
 1. \<And>uc i_s mode. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode); mode = InUserMode\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s)
 2. \<And>uc i_s mode. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode); mode = InIdleMode\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s)
 3. \<And>uc i_s mode x3. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode); mode = KernelEntry x3\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s)
 4. \<And>uc i_s mode. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode); mode = KernelPreempted\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s)
 5. \<And>uc i_s mode x5. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode); mode = KernelSchedule x5\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s)
 6. \<And>uc i_s mode. \<lbrakk>(((uc, i_s), mode), s') \<in> Step (ADT_A_if utf) (); invs_if ((uc, i_s), mode); 0 < measuref_if y ((uc, i_s), mode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), mode); mode = KernelExit\<rbrakk> \<Longrightarrow> measuref_if y s' < measuref_if y ((uc, i_s), mode) \<and> (\<not> interrupted_modes mode \<longrightarrow> \<not> interrupted_modes (snd s') \<longrightarrow> next_irq_state_of_state (internal_state_if s') = next_irq_state_of_state i_s) proof (prove)
goal (28 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if ba + 3 < 4 * irq_measure_if i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 6. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> 4 * irq_measure_if ba + 3 < 4 * irq_measure_if i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 6. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); e \<noteq> Interrupt; snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + 3 < 4 * irq_measure_if i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 6. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); e \<noteq> Interrupt; snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> 4 * irq_measure_if (i_s\<lparr>machine_state := machine_state i_s\<lparr>irq_state := irq_state_of_state i_s + 1\<rparr>\<rparr>) + 3 < 4 * irq_measure_if i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 6. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>uc i_s a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); e \<noteq> Interrupt; snd y = KernelExit; irq_at (Suc (irq_state_of_state i_s)) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> 4 * (next_irq_state (Suc (Suc (irq_state_of_state i_s))) (irq_masks_of_state i_s) - Suc (Suc (irq_state_of_state i_s))) + 3 < 4 * (next_irq_state_of_state i_s - Suc (irq_state_of_state i_s))
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 6. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>uc i_s a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); e \<noteq> Interrupt; snd y = KernelExit; irq_at (Suc (irq_state_of_state i_s)) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> 4 * (next_irq_state_of_state i_s - Suc (Suc (irq_state_of_state i_s))) + 3 < 4 * (next_irq_state_of_state i_s - Suc (irq_state_of_state i_s))
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 6. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt; snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); e \<noteq> Interrupt; snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); e \<noteq> Interrupt; snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state (i_s\<lparr>machine_state := machine_state i_s\<lparr>irq_state := irq_state_of_state i_s + 1\<rparr>\<rparr>) = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 5. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>uc i_s b a ba e. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), KernelEntry e); s' = ((a, ba), KernelEntry e); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((Some e, a), ba) \<in> fst (do_user_op_if utf uc b); e \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 4. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> irq_measure_if ba < irq_measure_if i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> irq_measure_if (i_s\<lparr>machine_state := machine_state i_s\<lparr>irq_state := irq_state_of_state i_s + 1\<rparr>\<rparr>) < irq_measure_if i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>uc i_s a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); snd y = KernelExit; irq_at (Suc (irq_state_of_state i_s)) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state (Suc (Suc (irq_state_of_state i_s))) (irq_masks_of_state i_s) - Suc (Suc (irq_state_of_state i_s)) < next_irq_state_of_state i_s - Suc (irq_state_of_state i_s)
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>uc i_s a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); snd y = KernelExit; irq_at (Suc (irq_state_of_state i_s)) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state i_s - Suc (Suc (irq_state_of_state i_s)) < next_irq_state_of_state i_s - Suc (irq_state_of_state i_s)
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 3. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state ba = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state (i_s\<lparr>machine_state := machine_state i_s\<lparr>irq_state := irq_state_of_state i_s + 1\<rparr>\<rparr>) = next_irq_state_of_state i_s
 2. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>uc i_s b a ba. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((a, ba), InUserMode); s' = ((a, ba), InUserMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); ((None, a), ba) \<in> fst (do_user_op_if utf uc b)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InUserMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InUserMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InUserMode)) + (case snd ((uc, i_s), InUserMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InUserMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InUserMode)) then 2 else if \<exists>b. snd ((uc, i_s), InUserMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InUserMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s b i. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), KernelEntry Interrupt); s' = ((uc, b), KernelEntry Interrupt); (Some i, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 5. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 23 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); s' = ((uc, b), InIdleMode); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> irq_measure_if (i_s\<lparr>machine_state := machine_state i_s\<lparr>irq_state := irq_state_of_state i_s + 1\<rparr>\<rparr>) < irq_measure_if i_s
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); s' = ((uc, b), InIdleMode); snd y = KernelExit; irq_at (Suc (irq_state_of_state i_s)) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state (Suc (Suc (irq_state_of_state i_s))) (irq_masks_of_state i_s) - Suc (Suc (irq_state_of_state i_s)) < next_irq_state_of_state i_s - Suc (irq_state_of_state i_s)
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); s' = ((uc, b), InIdleMode); snd y = KernelExit; irq_at (Suc (irq_state_of_state i_s)) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state i_s - Suc (Suc (irq_state_of_state i_s)) < next_irq_state_of_state i_s - Suc (irq_state_of_state i_s)
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); s' = ((uc, b), InIdleMode); snd y = KernelExit; irq_at (irq_state_of_state i_s + 1) (irq_masks_of_state i_s) = None\<rbrakk> \<Longrightarrow> next_irq_state_of_state (i_s\<lparr>machine_state := machine_state i_s\<lparr>irq_state := irq_state_of_state i_s + 1\<rparr>\<rparr>) = next_irq_state_of_state i_s
 2. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>uc i_s b. \<lbrakk>invs_if ((uc, i_s), InIdleMode); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), InIdleMode)) + (case snd ((uc, i_s), InIdleMode) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 2 else if snd ((uc, i_s), InIdleMode) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), InIdleMode)) then 2 else if \<exists>b. snd ((uc, i_s), InIdleMode) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), InIdleMode); step_restrict ((uc, b), InIdleMode); (None, b) \<in> fst (do_machine_op (getActiveIRQ False) i_s); s' = ((uc, b), InIdleMode)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 4. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>uc i_s x3 a b. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelPreempted); s' = ((a, b), KernelPreempted); ((uc, i_s), True, a, b) \<in> kernel_call_A_if x3; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>uc i_s x3 b s''. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((uc, b), KernelPreempted); s' = ((uc, b), KernelPreempted); x3 \<noteq> Interrupt; ((), s'') \<in> fst (thread_set (\<lambda>tcb. tcb\<lparr>tcb_arch := arch_tcb_context_set uc (tcb_arch tcb)\<rparr>) (cur_thread i_s) i_s); (Inl (), b) \<in> fst (handle_event x3 s'')\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) \<le> Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b \<le> irq_measure_if i_s
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); \<exists>ba. \<not> ba \<and> (\<exists>r. ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s) \<and> ba = (r = Inl ())); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b \<le> irq_measure_if i_s
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> irq_measure_if b \<le> irq_measure_if i_s
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
A total of 16 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> x3 \<noteq> Interrupt
 2. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> invs i_s
 3. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> domain_sep_inv False (?st718 uc i_s x3 a b ba bb r) i_s
 4. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> irq_is_recurring (?irq718 uc i_s x3 a b ba bb r) i_s
 5. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> ((Inr (), ?a718 uc i_s x3 a b ba bb r), b) \<in> fst (kernel_entry_if x3 (?uc718 uc i_s x3 a b ba bb r) i_s)
 6. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 20 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; \<not> bb; ((r, a), b) \<in> fst (kernel_entry_if x3 uc i_s); bb = (r = Inl ())\<rbrakk> \<Longrightarrow> ((Inr (), ?a718 uc i_s x3 a b ba bb r), b) \<in> fst (kernel_entry_if x3 (?uc718 uc i_s x3 a b ba bb r) i_s)
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt; snd y = KernelExit; r = Inr (); ((Inr (), a), b) \<in> fst (kernel_entry_if x3 uc i_s); \<not> bb\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; snd y = KernelExit; r = Inr (); ((Inr (), a), b) \<in> fst (kernel_entry_if x3 uc i_s); \<not> bb\<rbrakk> \<Longrightarrow> invs i_s
 2. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; snd y = KernelExit; r = Inr (); ((Inr (), a), b) \<in> fst (kernel_entry_if x3 uc i_s); \<not> bb\<rbrakk> \<Longrightarrow> domain_sep_inv False (?st749 uc i_s x3 a b ba bb r) i_s
 3. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; snd y = KernelExit; r = Inr (); ((Inr (), a), b) \<in> fst (kernel_entry_if x3 uc i_s); \<not> bb\<rbrakk> \<Longrightarrow> irq_is_recurring (?irq749 uc i_s x3 a b ba bb r) i_s
 4. \<And>uc i_s x3 a b ba bb r. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); s' = ((a, b), KernelSchedule False); \<not> ba; snd y = KernelExit; r = Inr (); ((Inr (), a), b) \<in> fst (kernel_entry_if x3 uc i_s); \<not> bb\<rbrakk> \<Longrightarrow> ((Inr (), ?a749 uc i_s x3 a b ba bb r), b) \<in> fst (kernel_entry_if x3 (?uc749 uc i_s x3 a b ba bb r) i_s)
 5. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 7. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 10. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 18 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>uc i_s x3 a b ba. \<lbrakk>invs_if ((uc, i_s), KernelEntry x3); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelEntry x3)) + (case snd ((uc, i_s), KernelEntry x3) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelEntry x3) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelEntry x3)) then 2 else if \<exists>b. snd ((uc, i_s), KernelEntry x3) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelEntry x3); step_restrict ((a, b), KernelSchedule False); ((uc, i_s), False, a, b) \<in> kernel_call_A_if x3; s' = ((a, b), KernelSchedule False); \<not> ba; x3 \<noteq> Interrupt\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 3. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 6. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 9. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 5. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 8. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) \<le> Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 5. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 8. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); (a, b) \<in> fst (schedule_if uc i_s); s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b \<le> irq_measure_if i_s
 2. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 5. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 8. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); (a, b) \<in> fst (schedule_if uc i_s); s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); ((uc, i_s), (), a, b) \<in> kernel_schedule_if; s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 3. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 6. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>uc i_s x5 a b. \<lbrakk>invs_if ((uc, i_s), KernelSchedule x5); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelSchedule x5); step_restrict ((a, b), KernelExit); (a, b) \<in> fst (schedule_if uc i_s); s' = ((a, b), KernelExit); snd y \<noteq> KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 3. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 6. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> irq_measure_if b < irq_measure_if i_s
 2. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 5. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 8. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 10. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (9 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 4. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 8. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (9 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); s' = ((a, b), KernelExit); snd y = KernelExit; (a, b) \<in> fst (kernel_exit_if uc i_s); KernelExit = (if ct_running b then InUserMode else InIdleMode)\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 4. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 7. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 8. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 9. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (8 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelExit); ((uc, i_s), KernelExit, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelExit)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 3. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 7. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 8. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (7 subgoals):
 1. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (4 * irq_measure_if b) < 4 * irq_measure_if i_s
 2. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 7. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (6 subgoals):
 1. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (6 subgoals):
 1. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), if ct_running b then InUserMode else InIdleMode); s' = ((a, b), if ct_running b then InUserMode else InIdleMode); snd y = KernelExit; (a, b) \<in> fst (kernel_exit_if uc i_s); KernelSchedule ba = (if ct_running b then InUserMode else InIdleMode)\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (5 subgoals):
 1. \<And>uc i_s a b ba. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelSchedule ba); ((uc, i_s), KernelSchedule ba, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelSchedule ba)\<rbrakk> \<Longrightarrow> snd y = KernelExit
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (3 subgoals):
 1. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b + (case m of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> 0) < Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (6 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), InUserMode); ((uc, i_s), InUserMode, a, b) \<in> kernel_exit_A_if; s' = ((a, b), InUserMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), InIdleMode); ((uc, i_s), InIdleMode, a, b) \<in> kernel_exit_A_if; s' = ((a, b), InIdleMode); InIdleMode \<noteq> KernelExit; \<forall>b. InIdleMode \<noteq> KernelSchedule b; \<not> interrupted_modes InIdleMode; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 3. \<And>uc i_s a b m x3. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelEntry x3); ((uc, i_s), KernelEntry x3, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelEntry x3); KernelEntry x3 \<noteq> KernelExit; \<forall>b. KernelEntry x3 \<noteq> KernelSchedule b; \<not> interrupted_modes (KernelEntry x3); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (Suc (4 * irq_measure_if b)) < 4 * irq_measure_if i_s
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelPreempted); ((uc, i_s), KernelPreempted, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelPreempted); KernelPreempted \<noteq> KernelExit; \<forall>b. KernelPreempted \<noteq> KernelSchedule b; \<not> interrupted_modes KernelPreempted; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (6 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>s' = ((a, b), InUserMode); snd y = KernelExit; invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), InUserMode); ct_running b; (a, b) \<in> fst (kernel_exit_if uc i_s)\<rbrakk> \<Longrightarrow> 4 * (next_irq_state_of_state b - Suc (irq_state_of_state b)) < Suc (4 * (next_irq_state_of_state i_s - Suc (irq_state_of_state i_s)))
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), InIdleMode); ((uc, i_s), InIdleMode, a, b) \<in> kernel_exit_A_if; s' = ((a, b), InIdleMode); InIdleMode \<noteq> KernelExit; \<forall>b. InIdleMode \<noteq> KernelSchedule b; \<not> interrupted_modes InIdleMode; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 3. \<And>uc i_s a b m x3. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelEntry x3); ((uc, i_s), KernelEntry x3, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelEntry x3); KernelEntry x3 \<noteq> KernelExit; \<forall>b. KernelEntry x3 \<noteq> KernelSchedule b; \<not> interrupted_modes (KernelEntry x3); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (Suc (4 * irq_measure_if b)) < 4 * irq_measure_if i_s
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelPreempted); ((uc, i_s), KernelPreempted, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelPreempted); KernelPreempted \<noteq> KernelExit; \<forall>b. KernelPreempted \<noteq> KernelSchedule b; \<not> interrupted_modes KernelPreempted; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 6. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (5 subgoals):
 1. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), InIdleMode); ((uc, i_s), InIdleMode, a, b) \<in> kernel_exit_A_if; s' = ((a, b), InIdleMode); InIdleMode \<noteq> KernelExit; \<forall>b. InIdleMode \<noteq> KernelSchedule b; \<not> interrupted_modes InIdleMode; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s a b m x3. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelEntry x3); ((uc, i_s), KernelEntry x3, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelEntry x3); KernelEntry x3 \<noteq> KernelExit; \<forall>b. KernelEntry x3 \<noteq> KernelSchedule b; \<not> interrupted_modes (KernelEntry x3); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (Suc (4 * irq_measure_if b)) < 4 * irq_measure_if i_s
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelPreempted); ((uc, i_s), KernelPreempted, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelPreempted); KernelPreempted \<noteq> KernelExit; \<forall>b. KernelPreempted \<noteq> KernelSchedule b; \<not> interrupted_modes KernelPreempted; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (5 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>s' = ((a, b), InIdleMode); snd y = KernelExit; invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), InIdleMode); \<not> ct_running b; (a, b) \<in> fst (kernel_exit_if uc i_s)\<rbrakk> \<Longrightarrow> 4 * (next_irq_state_of_state b - Suc (irq_state_of_state b)) < Suc (4 * (next_irq_state_of_state i_s - Suc (irq_state_of_state i_s)))
 2. \<And>uc i_s a b m x3. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelEntry x3); ((uc, i_s), KernelEntry x3, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelEntry x3); KernelEntry x3 \<noteq> KernelExit; \<forall>b. KernelEntry x3 \<noteq> KernelSchedule b; \<not> interrupted_modes (KernelEntry x3); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (Suc (4 * irq_measure_if b)) < 4 * irq_measure_if i_s
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelPreempted); ((uc, i_s), KernelPreempted, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelPreempted); KernelPreempted \<noteq> KernelExit; \<forall>b. KernelPreempted \<noteq> KernelSchedule b; \<not> interrupted_modes KernelPreempted; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 5. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (4 subgoals):
 1. \<And>uc i_s a b m x3. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelEntry x3); ((uc, i_s), KernelEntry x3, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelEntry x3); KernelEntry x3 \<noteq> KernelExit; \<forall>b. KernelEntry x3 \<noteq> KernelSchedule b; \<not> interrupted_modes (KernelEntry x3); snd y = KernelExit\<rbrakk> \<Longrightarrow> Suc (Suc (4 * irq_measure_if b)) < 4 * irq_measure_if i_s
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelPreempted); ((uc, i_s), KernelPreempted, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelPreempted); KernelPreempted \<noteq> KernelExit; \<forall>b. KernelPreempted \<noteq> KernelSchedule b; \<not> interrupted_modes KernelPreempted; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 4. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (3 subgoals):
 1. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), KernelPreempted); ((uc, i_s), KernelPreempted, a, b) \<in> kernel_exit_A_if; s' = ((a, b), KernelPreempted); KernelPreempted \<noteq> KernelExit; \<forall>b. KernelPreempted \<noteq> KernelSchedule b; \<not> interrupted_modes KernelPreempted; snd y = KernelExit\<rbrakk> \<Longrightarrow> 4 * irq_measure_if b < Suc (4 * irq_measure_if i_s)
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 3. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (2 subgoals):
 1. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m; snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (2 subgoals):
 1. \<And>uc i_s a b. \<lbrakk>invs_if ((uc, i_s), KernelExit); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), if ct_running b then InUserMode else InIdleMode); (a, b) \<in> fst (kernel_exit_if uc i_s); s' = ((a, b), if ct_running b then InUserMode else InIdleMode); (if ct_running b then InUserMode else InIdleMode) \<noteq> KernelExit; \<forall>ba. (if ct_running b then InUserMode else InIdleMode) \<noteq> KernelSchedule ba; \<not> interrupted_modes (if ct_running b then InUserMode else InIdleMode); snd y = KernelExit\<rbrakk> \<Longrightarrow> next_irq_state_of_state b = next_irq_state_of_state i_s
 2. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal (1 subgoal):
 1. \<And>uc i_s a b m. \<lbrakk>invs_if ((uc, i_s), KernelExit); 0 < (if snd y = KernelExit then if interrupted_modes (snd ((uc, i_s), KernelExit)) then 0 else 1 + 4 * irq_measure_if (internal_state_if ((uc, i_s), KernelExit)) + (case snd ((uc, i_s), KernelExit) of KernelEntry e \<Rightarrow> 3 | _ \<Rightarrow> if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 2 else if snd ((uc, i_s), KernelExit) = KernelExit then 1 else 0) else if interrupted_modes (snd ((uc, i_s), KernelExit)) then 2 else if \<exists>b. snd ((uc, i_s), KernelExit) = KernelSchedule b then 1 else 0); irq_is_recurring timer_irq i_s; s = ((uc, i_s), KernelExit); step_restrict ((a, b), m); ((uc, i_s), m, a, b) \<in> kernel_exit_A_if; s' = ((a, b), m); m \<noteq> KernelExit; \<forall>b. m \<noteq> KernelSchedule b; \<not> interrupted_modes m\<rbrakk> \<Longrightarrow> snd y = KernelExit proof (prove)
goal:
No subgoals!