[STATEMENT]
lemma round_robin_reschedule_correct:
  assumes det: "\<alpha>.deterministic I"
  and invar: "round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))" "state_invar s" "state_\<alpha> s \<in> I"
  and t0: "t0 \<in> set (queue_\<alpha> queue)"
  shows "map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) =
     \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)"
  and "case_option True (\<lambda>(t, taxm, \<sigma>). round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | Some (ta, x', m') \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})) (round_robin_reschedule t0 queue n0 s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s) &&& case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
using t0 invar
[PROOF STATE]
proof (prove)
using this:
t0 \<in> set (queue_\<alpha> queue)
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s) &&& case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
proof(induct "queue_\<alpha> queue" arbitrary: queue n rule: round_robin_reschedule_induct)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 4. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case head
[PROOF STATE]
proof (state)
this:
t0 # queue_ = queue_\<alpha> queue

goal (4 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 4. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
t0 # queue_ = queue_\<alpha> queue

goal (4 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 4. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (4 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 4. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
using head[symmetric]
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
queue_\<alpha> queue = t0 # queue_

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
by(subst round_robin_reschedule.simps)(subst \<alpha>.round_robin_reschedule.simps, clarsimp simp add: split_beta queue.dequeue_correct)
[PROOF STATE]
proof (state)
this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)

goal (3 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (3 subgoals):
 1. \<And>queue queuea n. \<lbrakk>t0 # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 3. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
using head[symmetric]
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
queue_\<alpha> queue = t0 # queue_

goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
by(subst round_robin_reschedule.simps)(clarsimp simp add: split_beta queue.dequeue_correct)
[PROOF STATE]
proof (state)
this:
case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>local.round_robin_invar (queue, ?na5) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case (rotate \<alpha>queue' t)
[PROOF STATE]
proof (state)
this:
t \<noteq> t0
t0 \<in> set \<alpha>queue'
\<lbrakk>\<alpha>queue' @ [t] = queue_\<alpha> ?queue3; local.round_robin_invar (?queue3, ?n3) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 ?queue3 n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> ?queue3) n0 (state_\<alpha> s)
\<lbrakk>\<alpha>queue' @ [t] = queue_\<alpha> ?queue3; local.round_robin_invar (?queue3, ?n3) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 ?queue3 n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
t # \<alpha>queue' = queue_\<alpha> queue

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
obtain t' queue' where queue': "queue_dequeue queue = (t', queue')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t' queue'. queue_dequeue queue = (t', queue') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases "queue_dequeue queue")
[PROOF STATE]
proof (state)
this:
queue_dequeue queue = (t', queue')

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
note [simp] = \<open>t # \<alpha>queue' = queue_\<alpha> queue\<close>[symmetric]
[PROOF STATE]
proof (state)
this:
queue_\<alpha> queue = t # \<alpha>queue'

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
queue_\<alpha> queue = t # \<alpha>queue'

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
with queue'
[PROOF STATE]
proof (chain)
picking this:
queue_dequeue queue = (t', queue')
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
[PROOF STEP]
have [simp]: "t' = t" "\<alpha>queue' = queue_\<alpha> queue'" "queue_invar queue'"
[PROOF STATE]
proof (prove)
using this:
queue_dequeue queue = (t', queue')
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. t' = t &&& \<alpha>queue' = queue_\<alpha> queue' &&& queue_invar queue'
[PROOF STEP]
by(auto elim: queue.removelE)
[PROOF STATE]
proof (state)
this:
t' = t
\<alpha>queue' = queue_\<alpha> queue'
queue_invar queue'

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
from 1 queue'
[PROOF STATE]
proof (chain)
picking this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
queue_dequeue queue = (t', queue')
[PROOF STEP]
have invar': "round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))"
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
queue_dequeue queue = (t', queue')

goal (1 subgoal):
 1. local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
by(auto simp add: queue.push_correct)
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (2 subgoals):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s)
 2. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
proof(cases "round_robin_step n0 (queue_push t queue', n0) s t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
 2. \<And>a. round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a\<rfloor> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
case Some
[PROOF STATE]
proof (state)
this:
round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a_\<rfloor>

goal (2 subgoals):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
 2. \<And>a. round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a\<rfloor> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a_\<rfloor>

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
using queue' \<open>t \<noteq> t0\<close> round_robin_step_correct[OF det invar' \<open>state_invar s\<close>, of n0 t] invar' \<open>state_\<alpha> s \<in> I\<close>
[PROOF STATE]
proof (prove)
using this:
round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a_\<rfloor>
queue_dequeue queue = (t', queue')
t \<noteq> t0
state_\<alpha> s \<in> I \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_step n0 (queue_push t queue', n0) s t) = \<alpha>.round_robin_step n0 (round_robin_\<alpha> (queue_push t queue', n0)) (state_\<alpha> s) t
state_\<alpha> s \<in> I \<Longrightarrow> case round_robin_step n0 (queue_push t queue', n0) s t of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
by(subst round_robin_reschedule.simps)(subst \<alpha>.round_robin_reschedule.simps, auto simp add: round_robin_\<alpha>_def queue.push_correct)
[PROOF STATE]
proof (state)
this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
round_robin_step n0 (queue_push t queue', n0) s t = None

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
hence \<alpha>None: "\<alpha>.round_robin_step n0 (queue_\<alpha> (queue_push t queue'), n0) (state_\<alpha> s) t = None"
[PROOF STATE]
proof (prove)
using this:
round_robin_step n0 (queue_push t queue', n0) s t = None

goal (1 subgoal):
 1. \<alpha>.round_robin_step n0 (queue_\<alpha> (queue_push t queue'), n0) (state_\<alpha> s) t = None
[PROOF STEP]
using round_robin_step_correct[OF det invar' \<open>state_invar s\<close>, of n0 t] invar' \<open>state_\<alpha> s \<in> I\<close>
[PROOF STATE]
proof (prove)
using this:
round_robin_step n0 (queue_push t queue', n0) s t = None
state_\<alpha> s \<in> I \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_step n0 (queue_push t queue', n0) s t) = \<alpha>.round_robin_step n0 (round_robin_\<alpha> (queue_push t queue', n0)) (state_\<alpha> s) t
state_\<alpha> s \<in> I \<Longrightarrow> case round_robin_step n0 (queue_push t queue', n0) s t of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. \<alpha>.round_robin_step n0 (queue_\<alpha> (queue_push t queue'), n0) (state_\<alpha> s) t = None
[PROOF STEP]
by(auto simp add: queue.push_correct round_robin_\<alpha>_def)
[PROOF STATE]
proof (state)
this:
\<alpha>.round_robin_step n0 (queue_\<alpha> (queue_push t queue'), n0) (state_\<alpha> s) t = None

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
have "\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
[PROOF STEP]
by(simp add: queue.enqueue_correct)
[PROOF STATE]
proof (state)
this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
from invar'
[PROOF STATE]
proof (chain)
picking this:
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
have "round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))"
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
by(auto simp add: queue.enqueue_correct queue.push_correct)
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
have "map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) =
            \<alpha>.round_robin_reschedule t0 (queue_\<alpha> (queue_enqueue t queue')) n0 (state_\<alpha> s)"
[PROOF STATE]
proof (prove)
using this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> (queue_enqueue t queue')) n0 (state_\<alpha> s)
[PROOF STEP]
using \<open>state_invar s\<close> \<open>state_\<alpha> s \<in> I\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> (queue_enqueue t queue')) n0 (state_\<alpha> s)
[PROOF STEP]
by(rule rotate.hyps)
[PROOF STATE]
proof (state)
this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> (queue_enqueue t queue')) n0 (state_\<alpha> s)

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> (queue_enqueue t queue')) n0 (state_\<alpha> s)

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
using None \<alpha>None \<open>t \<noteq> t0\<close> invar' queue'
[PROOF STATE]
proof (prove)
using this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> (queue_enqueue t queue')) n0 (state_\<alpha> s)
round_robin_step n0 (queue_push t queue', n0) s t = None
\<alpha>.round_robin_step n0 (queue_\<alpha> (queue_push t queue'), n0) (state_\<alpha> s) t = None
t \<noteq> t0
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
queue_dequeue queue = (t', queue')

goal (1 subgoal):
 1. map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)
[PROOF STEP]
by(subst round_robin_reschedule.simps)(subst \<alpha>.round_robin_reschedule.simps, auto simp add: queue.enqueue_correct queue.push_correct)
[PROOF STATE]
proof (state)
this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queue n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queue) n0 (state_\<alpha> s)

goal (1 subgoal):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
with queue'
[PROOF STATE]
proof (chain)
picking this:
queue_dequeue queue = (t', queue')
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
[PROOF STEP]
have [simp]: "t' = t" "\<alpha>queue' = queue_\<alpha> queue'" "queue_invar queue'"
[PROOF STATE]
proof (prove)
using this:
queue_dequeue queue = (t', queue')
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. t' = t &&& \<alpha>queue' = queue_\<alpha> queue' &&& queue_invar queue'
[PROOF STEP]
by(auto elim: queue.removelE)
[PROOF STATE]
proof (state)
this:
t' = t
\<alpha>queue' = queue_\<alpha> queue'
queue_invar queue'

goal (1 subgoal):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
from 2 queue'
[PROOF STATE]
proof (chain)
picking this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
queue_dequeue queue = (t', queue')
[PROOF STEP]
have invar': "round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))"
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue, n) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I
queue_dequeue queue = (t', queue')

goal (1 subgoal):
 1. local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
by(auto simp add: queue.push_correct)
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. \<And>queue t queuea n. \<lbrakk>t \<noteq> t0; t0 \<in> set queue; \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_reschedule t0 queuea n0 s) = \<alpha>.round_robin_reschedule t0 (queue_\<alpha> queuea) n0 (state_\<alpha> s); \<And>queuea n. \<lbrakk>queue @ [t] = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}); t # queue = queue_\<alpha> queuea; local.round_robin_invar (queuea, n) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queuea n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
proof(cases "round_robin_step n0 (queue_push t queue', n0) s t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 2. \<And>a. round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a\<rfloor> \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case Some
[PROOF STATE]
proof (state)
this:
round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a_\<rfloor>

goal (2 subgoals):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
 2. \<And>a. round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a\<rfloor> \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a_\<rfloor>

goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
using queue' \<open>t \<noteq> t0\<close> round_robin_step_correct[OF det invar' \<open>state_invar s\<close>, of n0 t] invar' \<open>state_\<alpha> s \<in> I\<close>
[PROOF STATE]
proof (prove)
using this:
round_robin_step n0 (queue_push t queue', n0) s t = \<lfloor>a_\<rfloor>
queue_dequeue queue = (t', queue')
t \<noteq> t0
state_\<alpha> s \<in> I \<Longrightarrow> map_option (apsnd (apsnd round_robin_\<alpha>)) (round_robin_step n0 (queue_push t queue', n0) s t) = \<alpha>.round_robin_step n0 (round_robin_\<alpha> (queue_push t queue', n0)) (state_\<alpha> s) t
state_\<alpha> s \<in> I \<Longrightarrow> case round_robin_step n0 (queue_push t queue', n0) s t of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
by(subst round_robin_reschedule.simps)(auto simp add: round_robin_\<alpha>_def queue.push_correct)
[PROOF STATE]
proof (state)
this:
case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
round_robin_step n0 (queue_push t queue', n0) s t = None

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
have "\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
[PROOF STEP]
by(simp add: queue.enqueue_correct)
[PROOF STATE]
proof (state)
this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
from invar'
[PROOF STATE]
proof (chain)
picking this:
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
have "round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))"
[PROOF STATE]
proof (prove)
using this:
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
by(auto simp add: queue.enqueue_correct queue.push_correct)
[PROOF STATE]
proof (state)
this:
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))
[PROOF STEP]
have "case_option True (\<lambda>(t, taxm, \<sigma>). round_robin_invar \<sigma> (case_option (dom (thr_\<alpha> (thr s))) (\<lambda>(ta, x', m'). dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>}) taxm)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s)"
[PROOF STATE]
proof (prove)
using this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))

goal (1 subgoal):
 1. case round_robin_reschedule t0 (queue_enqueue t queue') n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
using \<open>state_invar s\<close> \<open>state_\<alpha> s \<in> I\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>queue' @ [t] = queue_\<alpha> (queue_enqueue t queue')
local.round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\<alpha> (thr s)))
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. case round_robin_reschedule t0 (queue_enqueue t queue') n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
by(rule rotate.hyps)
[PROOF STATE]
proof (state)
this:
case round_robin_reschedule t0 (queue_enqueue t queue') n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal (1 subgoal):
 1. round_robin_step n0 (queue_push t queue', n0) s t = None \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
case round_robin_reschedule t0 (queue_enqueue t queue') n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
using None \<open>t \<noteq> t0\<close> invar' queue'
[PROOF STATE]
proof (prove)
using this:
case round_robin_reschedule t0 (queue_enqueue t queue') n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
round_robin_step n0 (queue_push t queue', n0) s t = None
t \<noteq> t0
local.round_robin_invar (queue_push t queue', n0) (dom (thr_\<alpha> (thr s)))
queue_dequeue queue = (t', queue')

goal (1 subgoal):
 1. case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})
[PROOF STEP]
by(subst round_robin_reschedule.simps)(auto simp add: queue.enqueue_correct queue.push_correct)
[PROOF STATE]
proof (state)
this:
case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal:
No subgoals!
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>local.round_robin_invar (queue, ?na5) (dom (thr_\<alpha> (thr s))); state_invar s; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> case round_robin_reschedule t0 queue n0 s of None \<Rightarrow> True | \<lfloor>(t, taxm, \<sigma>)\<rfloor> \<Rightarrow> local.round_robin_invar \<sigma> (case taxm of None \<Rightarrow> dom (thr_\<alpha> (thr s)) | \<lfloor>(ta, x', m')\<rfloor> \<Rightarrow> dom (thr_\<alpha> (thr s)) \<union> {t. \<exists>x m. NewThread t x m \<in> set \<lbrace>ta\<rbrace>\<^bsub>t\<^esub>})

goal:
No subgoals!
[PROOF STEP]
qed