[STATEMENT]
lemma red_external_wf_red:
  assumes wf: "wf_prog wf_md P"
  and red: "P,t \<turnstile> \<langle>a\<bullet>M(vs), h\<rangle> -ta\<rightarrow>ext \<langle>va, h'\<rangle>"
  and tconf: "P,h \<turnstile> t \<surd>t"
  and hconf: "hconf h"
  and wst: "wset s t = None \<or> (M = wait \<and> (\<exists>w. wset s t = \<lfloor>PostWS w\<rfloor>))"
  obtains ta' va' h''
  where "P,t \<turnstile> \<langle>a\<bullet>M(vs), h\<rangle> -ta'\<rightarrow>ext \<langle>va', h''\<rangle>"
  and "final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ta' va' h''. \<lbrakk>P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h''\<rangle>; final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof(atomize_elim)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>ta' va' h''. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h''\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?a_t = "thread_id2addr t"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>ta' va' h''. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h''\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?t_a = "addr2thread_id a"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>ta' va' h''. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h''\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from tconf
[PROOF STATE]
proof (chain)
picking this:
P,h \<turnstile> t \<surd>t
[PROOF STEP]
obtain C where ht: "typeof_addr h ?a_t = \<lfloor>Class_type C\<rfloor>"
    and sub: "P \<turnstile> C \<preceq>\<^sup>* Thread"
[PROOF STATE]
proof (prove)
using this:
P,h \<turnstile> t \<surd>t

goal (1 subgoal):
 1. (\<And>C. \<lbrakk>typeof_addr h (thread_id2addr t) = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce dest: tconfD)
[PROOF STATE]
proof (state)
this:
typeof_addr h (thread_id2addr t) = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. \<exists>ta' va' h''. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h''\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
show "\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs), h\<rangle> -ta'\<rightarrow>ext \<langle>va', h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof(cases "final_thread.actions_ok' s t ta")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t ta

goal (2 subgoals):
 1. final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
have "final_thread.actions_subset ta ta"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_subset ta ta
[PROOF STEP]
by(rule final_thread.actions_subset_refl)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset ta ta

goal (2 subgoals):
 1. final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
with True red
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta\<rightarrow>ext \<langle>va,h'\<rangle>
final_thread.actions_subset ta ta
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta\<rightarrow>ext \<langle>va,h'\<rangle>
final_thread.actions_subset ta ta

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (1 subgoal):
 1. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
note [simp] = final_thread.actions_ok'_iff lock_ok_las'_def final_thread.cond_action_oks'_subset_Join
      final_thread.actions_subset_iff ta_upd_simps collect_cond_actions_def collect_interrupts_def
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' ?s ?t ?ta = (lock_ok_las' (locks ?s) ?t \<lbrace>?ta\<rbrace>\<^bsub>l\<^esub> \<and> thread_oks (thr ?s) \<lbrace>?ta\<rbrace>\<^bsub>t\<^esub> \<and> final_thread.cond_action_oks' ?s ?t \<lbrace>?ta\<rbrace>\<^bsub>c\<^esub> \<and> wset_actions_ok (wset ?s) ?t \<lbrace>?ta\<rbrace>\<^bsub>w\<^esub> \<and> interrupt_actions_ok' (interrupts ?s) \<lbrace>?ta\<rbrace>\<^bsub>i\<^esub>)
lock_ok_las' ?ls ?t ?las \<equiv> \<forall>l. lock_actions_ok' (?ls $ l) ?t (?las $ l)
set ?cts \<subseteq> insert Yield (range Join) \<Longrightarrow> final_thread.cond_action_oks' ?s ?t ?cts
final_thread.actions_subset ?ta' ?ta = (collect_locks' \<lbrace>?ta'\<rbrace>\<^bsub>l\<^esub> \<subseteq> collect_locks \<lbrace>?ta\<rbrace>\<^bsub>l\<^esub> \<and> collect_cond_actions \<lbrace>?ta'\<rbrace>\<^bsub>c\<^esub> \<subseteq> collect_cond_actions \<lbrace>?ta\<rbrace>\<^bsub>c\<^esub> \<and> collect_interrupts \<lbrace>?ta'\<rbrace>\<^bsub>i\<^esub> \<subseteq> collect_interrupts \<lbrace>?ta\<rbrace>\<^bsub>i\<^esub>)
ta_update_locks (?ls, ?nts, ?js, ?wss, ?obs) ?lta ?l = (?ls(?l $:= ?ls $ ?l @ [?lta]), ?nts, ?js, ?wss, ?obs)
ta_update_NewThread (?ls, ?nts, ?js, ?wss, ?is, ?obs) ?nt = (?ls, ?nts @ [?nt], ?js, ?wss, ?is, ?obs)
ta_update_Conditional (?ls, ?nts, ?js, ?wss, ?is, ?obs) ?j = (?ls, ?nts, ?js @ [?j], ?wss, ?is, ?obs)
ta_update_wait_set (?ls, ?nts, ?js, ?wss, ?is, ?obs) ?ws = (?ls, ?nts, ?js, ?wss @ [?ws], ?is, ?obs)
ta_update_interrupt (?ls, ?nts, ?js, ?wss, ?is, ?obs) ?i = (?ls, ?nts, ?js, ?wss, ?is @ [?i], ?obs)
ta_update_obs (?ls, ?nts, ?js, ?wss, ?is, ?obs) ?ob = (?ls, ?nts, ?js, ?wss, ?is, ?obs @ [?ob])
FWState.thread_action'_to_thread_action (?la, ?l) ?ta = ta_update_locks ?ta ?la ?l
FWState.thread_action'_to_thread_action ?nt ?ta = ta_update_NewThread ?ta ?nt
FWState.thread_action'_to_thread_action ?ca ?ta = ta_update_Conditional ?ta ?ca
FWState.thread_action'_to_thread_action ?wa ?ta = ta_update_wait_set ?ta ?wa
FWState.thread_action'_to_thread_action ?ia ?ta = ta_update_interrupt ?ta ?ia
FWState.thread_action'_to_thread_action ?ob ?ta = ta_update_obs ?ta ?ob
collect_cond_actions ?cts = {t. Join t \<in> set ?cts}
collect_interrupts ?ias = foldr collect_interrupt ?ias {}

goal (1 subgoal):
 1. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
note [rule del] = subsetI
[PROOF STATE]
proof (state)
this:
(\<And>x. x \<in> ?A \<Longrightarrow> x \<in> ?B) \<Longrightarrow> ?A \<subseteq> ?B

goal (1 subgoal):
 1. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
note [intro] = collect_locks'_subset_collect_locks red_external.intros[simplified]
[PROOF STATE]
proof (state)
this:
collect_locks' ?las \<subseteq> collect_locks ?las
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>start([]),?h\<rangle> -(K$ [], [NewThread (addr2thread_id ?a) (?C, run, ?a) ?h], [], [], [], [ThreadStart (addr2thread_id ?a)])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>start([]),?h\<rangle> -(K$ [], [ThreadExists (addr2thread_id ?a) True], [], [], [], [])\<rightarrow>ext \<langle>RetEXC IllegalThreadState,?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>join([]),?h\<rangle> -(K$ [], [], [Join (addr2thread_id ?a)], [], [IsInterrupted ?t False], [ThreadJoin (addr2thread_id ?a)])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>join([]),?h\<rangle> -(K$ [], [], [], [], [IsInterrupted ?t True, ClearInterrupt ?t], [ObsInterrupted ?t])\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>interrupt([]),?h\<rangle> -(K$ [], [ThreadExists (addr2thread_id ?a) True], [], [WakeUp (addr2thread_id ?a)], [Interrupt (addr2thread_id ?a)], [ObsInterrupt (addr2thread_id ?a)])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>interrupt([]),?h\<rangle> -(K$ [], [ThreadExists (addr2thread_id ?a) False], [], [], [], [])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>isInterrupted([]),?h\<rangle> -(K$ [], [], [], [], [IsInterrupted (addr2thread_id ?a) True], [ObsInterrupted (addr2thread_id ?a)])\<rightarrow>ext \<langle>RetVal (Bool True),?h\<rangle>
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>isInterrupted([]),?h\<rangle> -(K$ [], [], [], [], [IsInterrupted (addr2thread_id ?a) False], [])\<rightarrow>ext \<langle>RetVal (Bool False),?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -((K$ [])(?a $:= [Unlock, Lock]), [], [], [], [IsInterrupted ?t True, ClearInterrupt ?t], [ObsInterrupted ?t])\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -((K$ [])(?a $:= [Unlock, Lock, ReleaseAcquire]), [], [], [Suspend ?a], [IsInterrupted ?t False], [SyncUnlock ?a])\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -((K$ [])(?a $:= [UnlockFail]), [], [], [], [], [])\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -(K$ [], [], [], [Notified], [], [])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -(K$ [], [], [], [WokenUp], [ClearInterrupt ?t], [ObsInterrupted ?t])\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
spurious_wakeups \<Longrightarrow> heap_base.red_external addr2thread_id thread_id2addr True empty_heap allocate typeof_addr heap_read heap_write ?P ?t ?h ?a wait [] ((K$ [])(?a $:= [Unlock, Lock, ReleaseAcquire]), [], [], [], [IsInterrupted ?t False], [SyncUnlock ?a]) (RetVal Unit) ?h
?P,?t \<turnstile> \<langle>?a\<bullet>notify([]),?h\<rangle> -((K$ [])(?a $:= [Unlock, Lock]), [], [], [Notify ?a], [], [])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>notify([]),?h\<rangle> -((K$ [])(?a $:= [UnlockFail]), [], [], [], [], [])\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>notifyAll([]),?h\<rangle> -((K$ [])(?a $:= [Unlock, Lock]), [], [], [NotifyAll ?a], [], [])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>notifyAll([]),?h\<rangle> -((K$ [])(?a $:= [UnlockFail]), [], [], [], [], [])\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
heap_clone ?P ?h ?a ?h' \<lfloor>(?obs, ?a')\<rfloor> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>clone([]),?h\<rangle> -(K$ [], [], [], [], [], ?obs)\<rightarrow>ext \<langle>RetVal (Addr ?a'),?h'\<rangle>
heap_clone ?P ?h ?a ?h' None \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>clone([]),?h\<rangle> -\<lbrace>\<rbrace>\<rightarrow>ext \<langle>RetEXC OutOfMemory,?h'\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>hashcode([]),?h\<rangle> -\<lbrace>\<rbrace>\<rightarrow>ext \<langle>RetVal (Intg (word_of_int (hash_addr ?a))),?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>print(?vs),?h\<rangle> -(K$ [], [], [], [], [], [ExternalCall ?a print ?vs Unit])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>currentThread([]),?h\<rangle> -\<lbrace>\<rbrace>\<rightarrow>ext \<langle>RetVal (Addr (thread_id2addr ?t)),?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>interrupted([]),?h\<rangle> -(K$ [], [], [], [], [IsInterrupted ?t True, ClearInterrupt ?t], [ObsInterrupted ?t])\<rightarrow>ext \<langle>RetVal (Bool True),?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>interrupted([]),?h\<rangle> -(K$ [], [], [], [], [IsInterrupted ?t False], [])\<rightarrow>ext \<langle>RetVal (Bool False),?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>yield([]),?h\<rangle> -(K$ [], [], [Yield], [], [], [])\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>

goal (1 subgoal):
 1. \<not> final_thread.actions_ok' s t ta \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof(cases "wset s t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>aa. wset s t = \<lfloor>aa\<rfloor> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case [simp]: (Some w)
[PROOF STATE]
proof (state)
this:
wset s t = \<lfloor>w\<rfloor>

goal (2 subgoals):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>aa. wset s t = \<lfloor>aa\<rfloor> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
with wst
[PROOF STATE]
proof (chain)
picking this:
wset s t = None \<or> M = wait \<and> (\<exists>w. wset s t = \<lfloor>PostWS w\<rfloor>)
wset s t = \<lfloor>w\<rfloor>
[PROOF STEP]
obtain w' where [simp]: "w = PostWS w'" "M = wait"
[PROOF STATE]
proof (prove)
using this:
wset s t = None \<or> M = wait \<and> (\<exists>w. wset s t = \<lfloor>PostWS w\<rfloor>)
wset s t = \<lfloor>w\<rfloor>

goal (1 subgoal):
 1. (\<And>w'. \<lbrakk>w = PostWS w'; M = wait\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
w = PostWS w'
M = wait

goal (2 subgoals):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>aa. wset s t = \<lfloor>aa\<rfloor> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from red
[PROOF STATE]
proof (chain)
picking this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
have [simp]: "vs = []"
[PROOF STATE]
proof (prove)
using this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. vs = []
[PROOF STEP]
by(auto elim: red_external.cases)
[PROOF STATE]
proof (state)
this:
vs = []

goal (2 subgoals):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>aa. wset s t = \<lfloor>aa\<rfloor> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof(cases w')
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case [simp]: WSWokenUp
[PROOF STATE]
proof (state)
this:
w' = WSWokenUp

goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
by(simp add: wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace> ta

goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace> ta

goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWaitInterrupted
[PROOF STATE]
proof (chain)
picking this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>WokenUp, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
[PROOF STEP]
have "\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>WokenUp, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>

goal (1 subgoal):
 1. \<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (2 subgoals):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. w' = WSWokenUp \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>
final_thread.actions_subset \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace> ta
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>
final_thread.actions_subset \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace> ta
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case [simp]: WSNotified
[PROOF STATE]
proof (state)
this:
w' = WSNotified

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>Notified\<rbrace>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>Notified\<rbrace>
[PROOF STEP]
by(simp add: wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>Notified\<rbrace>

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>Notified\<rbrace>

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>Notified\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>Notified\<rbrace> ta

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>Notified\<rbrace> ta

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWaitNotified
[PROOF STATE]
proof (chain)
picking this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Notified\<rbrace>\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
[PROOF STEP]
have "\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Notified\<rbrace>\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>

goal (1 subgoal):
 1. \<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notified\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notified\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. w' = WSNotified \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>Notified\<rbrace>
final_thread.actions_subset \<lbrace>Notified\<rbrace> ta
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notified\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>Notified\<rbrace>
final_thread.actions_subset \<lbrace>Notified\<rbrace> ta
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notified\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (1 subgoal):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case None
[PROOF STATE]
proof (state)
this:
wset s t = None

goal (1 subgoal):
 1. wset s t = None \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from red False
[PROOF STATE]
proof (chain)
picking this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta\<rightarrow>ext \<langle>va,h'\<rangle>
\<not> final_thread.actions_ok' s t ta
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta\<rightarrow>ext \<langle>va,h'\<rangle>
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
case (RedNewThread C)
[PROOF STATE]
proof (state)
this:
M = start
vs = []
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>NewThread ?t_a (C, run, a) h, ThreadStart ?t_a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>

goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
let ?ta' = "\<lbrace>ThreadExists ?t_a True\<rbrace>"
[PROOF STATE]
proof (state)
goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>

goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>

goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace> ta
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace> ta

goal (26 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 26 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
final_thread.actions_subset \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace> ta
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
final_thread.actions_subset \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace> ta

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
using RedNewThread
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
final_thread.actions_subset \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace> ta
M = start
vs = []
ta = \<lbrace>NewThread (addr2thread_id a) (C, run, a) h, ThreadStart (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
case RedNewThreadFail
[PROOF STATE]
proof (state)
this:
M = start
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
va = RetEXC IllegalThreadState
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
M = start
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
va = RetEXC IllegalThreadState
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
[PROOF STEP]
obtain va' h' x where "P,t \<turnstile> \<langle>a\<bullet>M(vs), h\<rangle> -\<lbrace>NewThread ?t_a x h', ThreadStart ?t_a\<rbrace>\<rightarrow>ext \<langle>va', h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = start
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
va = RetEXC IllegalThreadState
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. (\<And>x h' va'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va',h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va',h'\<rangle>

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va',h'\<rangle>

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
from \<open>ta = \<lbrace>ThreadExists ?t_a True\<rbrace>\<close> False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "final_thread.actions_ok' s t \<lbrace>NewThread ?t_a x h', ThreadStart ?t_a\<rbrace>"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
from \<open>ta = \<lbrace>ThreadExists ?t_a True\<rbrace>\<close>
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset \<lbrace>NewThread ?t_a x h', ThreadStart ?t_a\<rbrace> ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace> ta
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace> ta

goal (25 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = start; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True\<rbrace>; va = RetEXC IllegalThreadState; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 25 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va',h'\<rangle>
final_thread.actions_ok' s t \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>
final_thread.actions_subset \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace> ta
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va',h'\<rangle>
final_thread.actions_ok' s t \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace>
final_thread.actions_subset \<lbrace>NewThread (addr2thread_id a) x h', ThreadStart (addr2thread_id a)\<rbrace> ta

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
case RedJoin
[PROOF STATE]
proof (state)
this:
M = join
vs = []
ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
let ?ta = "\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>"
[PROOF STATE]
proof (state)
goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
from \<open>ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>\<close> None False
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>
wset s t = None
\<not> final_thread.actions_ok' s t ta
[PROOF STEP]
have "t \<in> interrupts s"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>
wset s t = None
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. t \<in> interrupts s
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
t \<in> interrupts s

goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok final s t ?ta"
[PROOF STATE]
proof (prove)
using this:
t \<in> interrupts s

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
t \<in> interrupts s
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RedJoinInterrupt RedJoin
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>join([]),?h\<rangle> -\<lbrace>IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
M = join
vs = []
ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (24 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>Join (addr2thread_id a), IsInterrupted t False, ThreadJoin (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 24 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (23 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 23 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (23 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 23 subgoals...
[PROOF STEP]
case RedJoinInterrupt
[PROOF STATE]
proof (state)
this:
M = join
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (23 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 23 subgoals...
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
M = join
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. False
[PROOF STEP]
using False None
[PROOF STATE]
proof (prove)
using this:
M = join
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. False
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
False

goal (23 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = join; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 23 subgoals...
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
case RedInterrupt
[PROOF STATE]
proof (state)
this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
let ?ta = "\<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>"
[PROOF STATE]
proof (state)
goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
from RedInterrupt None False
[PROOF STATE]
proof (chain)
picking this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
wset s t = None
\<not> final_thread.actions_ok' s t ta
[PROOF STEP]
have "free_thread_id (thr s) (addr2thread_id a)"
[PROOF STATE]
proof (prove)
using this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
wset s t = None
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. free_thread_id (thr s) (addr2thread_id a)
[PROOF STEP]
by(auto simp add: wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
free_thread_id (thr s) (addr2thread_id a)

goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok final s t ?ta"
[PROOF STATE]
proof (prove)
using this:
free_thread_id (thr s) (addr2thread_id a)

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
free_thread_id (thr s) (addr2thread_id a)
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>

goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>

goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RedInterruptInexist RedInterrupt
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>interrupt([]),?h\<rangle> -\<lbrace>ThreadExists (addr2thread_id ?a) False\<rbrace>\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (22 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 22 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
case RedInterruptInexist
[PROOF STATE]
proof (state)
this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread

goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
let ?ta = "\<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>"
[PROOF STATE]
proof (state)
goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
from RedInterruptInexist None False
[PROOF STATE]
proof (chain)
picking this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
wset s t = None
\<not> final_thread.actions_ok' s t ta
[PROOF STEP]
have "\<not> free_thread_id (thr s) (addr2thread_id a)"
[PROOF STATE]
proof (prove)
using this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
wset s t = None
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. \<not> free_thread_id (thr s) (addr2thread_id a)
[PROOF STEP]
by(auto simp add: wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
\<not> free_thread_id (thr s) (addr2thread_id a)

goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok final s t ?ta"
[PROOF STATE]
proof (prove)
using this:
\<not> free_thread_id (thr s) (addr2thread_id a)

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
\<not> free_thread_id (thr s) (addr2thread_id a)
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>

goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>

goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RedInterruptInexist RedInterrupt
[PROOF STATE]
proof (prove)
using this:
M = interrupt
vs = []
ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>
va = RetVal Unit
h' = h
typeof_addr h a = \<lfloor>Class_type C_\<rfloor>
P \<turnstile> C_ \<preceq>\<^sup>* Thread
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>interrupt([]),?h\<rangle> -\<lbrace>ThreadExists (addr2thread_id ?a) True, WakeUp (addr2thread_id ?a), Interrupt (addr2thread_id ?a), ObsInterrupt (addr2thread_id ?a)\<rbrace>\<rightarrow>ext \<langle>RetVal Unit,?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (21 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupt; vs = []; ta = \<lbrace>ThreadExists (addr2thread_id a) False\<rbrace>; va = RetVal Unit; h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 21 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>ThreadExists (addr2thread_id a) True, WakeUp (addr2thread_id a), Interrupt (addr2thread_id a), ObsInterrupt (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
case (RedIsInterruptedTrue C)
[PROOF STATE]
proof (state)
this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
let ?ta' = "\<lbrace>IsInterrupted ?t_a False\<rbrace>"
[PROOF STATE]
proof (state)
goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
from RedIsInterruptedTrue False None
[PROOF STATE]
proof (chain)
picking this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "?t_a \<notin> interrupts s"
[PROOF STATE]
proof (prove)
using this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. addr2thread_id a \<notin> interrupts s
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
addr2thread_id a \<notin> interrupts s

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
addr2thread_id a \<notin> interrupts s

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
addr2thread_id a \<notin> interrupts s
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
from RedIsInterruptedTrue
[PROOF STATE]
proof (chain)
picking this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace> ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace> ta

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace> ta

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
from RedIsInterruptedTrue RedIsInterruptedFalse
[PROOF STATE]
proof (chain)
picking this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>isInterrupted([]),?h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id ?a) False\<rbrace>\<rightarrow>ext \<langle>RetVal (Bool False),?h\<rangle>
[PROOF STEP]
obtain va h'
          where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
va = RetVal (Bool True)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>isInterrupted([]),?h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id ?a) False\<rbrace>\<rightarrow>ext \<langle>RetVal (Bool False),?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (20 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>; va = RetVal (Bool True); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 20 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
final_thread.actions_subset \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
final_thread.actions_subset \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
case (RedIsInterruptedFalse C)
[PROOF STATE]
proof (state)
this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
va = RetVal (Bool False)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
let ?ta' = "\<lbrace>IsInterrupted ?t_a True, ObsInterrupted ?t_a\<rbrace>"
[PROOF STATE]
proof (state)
goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
from RedIsInterruptedFalse
[PROOF STATE]
proof (chain)
picking this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
va = RetVal (Bool False)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
[PROOF STEP]
have "?t_a \<in> interrupts s"
[PROOF STATE]
proof (prove)
using this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
va = RetVal (Bool False)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread

goal (1 subgoal):
 1. addr2thread_id a \<in> interrupts s
[PROOF STEP]
using False None
[PROOF STATE]
proof (prove)
using this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
va = RetVal (Bool False)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. addr2thread_id a \<in> interrupts s
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
addr2thread_id a \<in> interrupts s

goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
addr2thread_id a \<in> interrupts s

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
addr2thread_id a \<in> interrupts s
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>

goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>

goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RedIsInterruptedFalse RedIsInterruptedTrue
[PROOF STATE]
proof (prove)
using this:
M = isInterrupted
vs = []
ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>
va = RetVal (Bool False)
h' = h
typeof_addr h a = \<lfloor>Class_type C\<rfloor>
P \<turnstile> C \<preceq>\<^sup>* Thread
\<lbrakk>typeof_addr ?h ?a = \<lfloor>Class_type ?C\<rfloor>; ?P \<turnstile> ?C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> ?P,?t \<turnstile> \<langle>?a\<bullet>isInterrupted([]),?h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id ?a) True, ObsInterrupted (addr2thread_id ?a)\<rbrace>\<rightarrow>ext \<langle>RetVal (Bool True),?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (19 subgoals):
 1. \<And>C. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = isInterrupted; vs = []; ta = \<lbrace>IsInterrupted (addr2thread_id a) False\<rbrace>; va = RetVal (Bool False); h' = h; typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 19 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted (addr2thread_id a) True, ObsInterrupted (addr2thread_id a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (18 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 18 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (18 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 18 subgoals...
[PROOF STEP]
case RedWaitInterrupt
[PROOF STATE]
proof (state)
this:
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h

goal (18 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 18 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (18 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 18 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have hli: "\<not> has_lock (locks s $ a) t \<or> t \<notin> interrupts s"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<or> t \<notin> interrupts s
[PROOF STEP]
by(fastforce simp add: lock_actions_ok'_iff finfun_upd_apply split: if_split_asm dest: may_lock_t_may_lock_unlock_lock_t dest: has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t \<or> t \<notin> interrupts s

goal (18 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 18 subgoals...
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof(cases "has_lock (locks s $ a) t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
has_lock (locks s $ a) t

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>Suspend a, Unlock\<rightarrow>a, Lock\<rightarrow>a, ReleaseAcquire\<rightarrow>a, IsInterrupted t False, SyncUnlock a \<rbrace>"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from True hli
[PROOF STATE]
proof (chain)
picking this:
has_lock (locks s $ a) t
\<not> has_lock (locks s $ a) t \<or> t \<notin> interrupts s
[PROOF STEP]
have "t \<notin> interrupts s"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> has_lock (locks s $ a) t \<or> t \<notin> interrupts s

goal (1 subgoal):
 1. t \<notin> interrupts s
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
t \<notin> interrupts s

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
with True False
[PROOF STATE]
proof (chain)
picking this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<notin> interrupts s
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<notin> interrupts s

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<notin> interrupts s
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply wset_actions_ok_def Cons_eq_append_conv)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> ta

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> ta

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWait RedWaitInterrupt
[PROOF STATE]
proof (chain)
picking this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
final_thread.actions_subset \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
final_thread.actions_subset \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from False
[PROOF STATE]
proof (chain)
picking this:
\<not> has_lock (locks s $ a) t
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWaitInterrupt
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (17 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 17 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (17 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 17 subgoals...
[PROOF STEP]
case RedWait
[PROOF STATE]
proof (state)
this:
M = wait
vs = []
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetStaySame
h' = h

goal (17 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 17 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>Suspend a, Unlock\<rightarrow>a, Lock\<rightarrow>a, ReleaseAcquire\<rightarrow>a, IsInterrupted t False, SyncUnlock a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>

goal (17 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 17 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have hli: "\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply wset_actions_ok_def Cons_eq_append_conv split: if_split_asm dest: may_lock_t_may_lock_unlock_lock_t dest: has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s

goal (17 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetStaySame; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 17 subgoals...
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof(cases "has_lock (locks s $ a) t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
has_lock (locks s $ a) t

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from True hli
[PROOF STATE]
proof (chain)
picking this:
has_lock (locks s $ a) t
\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s
[PROOF STEP]
have "t \<in> interrupts s"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s

goal (1 subgoal):
 1. t \<in> interrupts s
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
t \<in> interrupts s

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
with True False
[PROOF STATE]
proof (chain)
picking this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<in> interrupts s
[PROOF STEP]
have "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<in> interrupts s

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<in> interrupts s
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps lock_ok_las_def finfun_upd_apply has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWait RedWaitInterrupt
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetStaySame
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetStaySame
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from False
[PROOF STATE]
proof (chain)
picking this:
\<not> has_lock (locks s $ a) t
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWait RedWaitFail
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetStaySame
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetStaySame
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
case RedWaitFail
[PROOF STATE]
proof (state)
this:
M = wait
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>UnlockFail\<rightarrow>a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
let ?ta' = "if t \<in> interrupts s
                   then \<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
                   else \<lbrace>Suspend a, Unlock\<rightarrow>a, Lock\<rightarrow>a, ReleaseAcquire\<rightarrow>a, IsInterrupted t False, SyncUnlock a \<rbrace>"
[PROOF STATE]
proof (state)
goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "has_lock (locks s $ a) t"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. has_lock (locks s $ a) t
[PROOF STEP]
by(auto simp add: finfun_upd_apply split: if_split_asm)
[PROOF STATE]
proof (state)
this:
has_lock (locks s $ a) t

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok final s t (if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>)
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t (if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>)
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps lock_ok_las_def finfun_upd_apply has_lock_may_lock wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t (if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>)

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t (if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>)

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
from RedWaitFail RedWait RedWaitInterrupt
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases "t \<in> interrupts s") (auto)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (16 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 16 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t (if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>)
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t (if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>)
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
case RedWaitNotified
[PROOF STATE]
proof (state)
this:
M = wait
vs = []
ta = \<lbrace>Notified\<rbrace>
va = RetVal Unit
h' = h

goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>Notified\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>Notified\<rbrace>

goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
let ?ta' = "if has_lock (locks s $ a) t
                   then (if t \<in> interrupts s
                         then \<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
                         else \<lbrace>Suspend a, Unlock\<rightarrow>a, Lock\<rightarrow>a, ReleaseAcquire\<rightarrow>a, IsInterrupted t False, SyncUnlock a \<rbrace>)
                   else \<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
have "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps lock_ok_las_def finfun_upd_apply has_lock_may_lock wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)

goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)

goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
from RedWaitNotified RedWait RedWaitInterrupt RedWaitFail
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>Notified\<rbrace>
va = RetVal Unit
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
[PROOF STEP]
have "\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>Notified\<rbrace>
va = RetVal Unit
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>

goal (1 subgoal):
 1. \<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (15 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>Notified\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 15 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
case RedWaitInterrupted
[PROOF STATE]
proof (state)
this:
M = wait
vs = []
ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h

goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
let ?ta' = "if has_lock (locks s $ a) t
                   then (if t \<in> interrupts s
                         then \<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
                         else \<lbrace>Suspend a, Unlock\<rightarrow>a, Lock\<rightarrow>a, ReleaseAcquire\<rightarrow>a, IsInterrupted t False, SyncUnlock a \<rbrace>)
                   else \<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
have "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps lock_ok_las_def finfun_upd_apply has_lock_may_lock wset_actions_ok_def)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)

goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)

goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
from RedWaitInterrupted RedWait RedWaitInterrupt RedWaitFail
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
[PROOF STEP]
have "\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetEXC InterruptedException
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>Suspend ?a, (Unlock, ?a), (Lock, ?a), (ReleaseAcquire, ?a), IsInterrupted ?t False, SyncUnlock ?a\<rbrace>\<rightarrow>ext \<langle>RetStaySame,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>

goal (1 subgoal):
 1. \<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (14 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>WokenUp, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetEXC InterruptedException; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 14 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t (if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>)
\<exists>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -if has_lock (locks s $ a) t then if t \<in> interrupts s then \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace> else \<lbrace>Suspend a, (Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace> else \<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (13 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 13 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (13 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 13 subgoals...
[PROOF STEP]
case RedWaitSpurious
[PROOF STATE]
proof (state)
this:
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetVal Unit
h' = h
spurious_wakeups

goal (13 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 13 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, ReleaseAcquire\<rightarrow>a, IsInterrupted t False, SyncUnlock a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>

goal (13 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 13 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have hli: "\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply wset_actions_ok_def Cons_eq_append_conv split: if_split_asm dest: may_lock_t_may_lock_unlock_lock_t dest: has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s

goal (13 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = wait; vs = []; ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>; va = RetVal Unit; h' = h; spurious_wakeups\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 13 subgoals...
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
proof(cases "has_lock (locks s $ a) t")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
has_lock (locks s $ a) t

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>Unlock\<rightarrow>a, Lock\<rightarrow>a, IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from True hli
[PROOF STATE]
proof (chain)
picking this:
has_lock (locks s $ a) t
\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s
[PROOF STEP]
have "t \<in> interrupts s"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> has_lock (locks s $ a) t \<or> t \<in> interrupts s

goal (1 subgoal):
 1. t \<in> interrupts s
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
t \<in> interrupts s

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
with True False
[PROOF STATE]
proof (chain)
picking this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<in> interrupts s
[PROOF STEP]
have "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<in> interrupts s

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
\<not> final_thread.actions_ok' s t ta
t \<in> interrupts s
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps lock_ok_las_def finfun_upd_apply has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWaitInterrupt RedWaitSpurious(1-5)
[PROOF STATE]
proof (chain)
picking this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetVal Unit
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(Unlock, ?a), (Lock, ?a), IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetEXC InterruptedException,?h\<rangle>
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetVal Unit
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (2 subgoals):
 1. has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(Unlock, a), (Lock, a), IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from False
[PROOF STATE]
proof (chain)
picking this:
\<not> has_lock (locks s $ a) t
[PROOF STEP]
have "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedWaitSpurious(1-5) RedWaitFail
[PROOF STATE]
proof (chain)
picking this:
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetVal Unit
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = wait
vs = []
ta = \<lbrace>(Unlock, a), (Lock, a), (ReleaseAcquire, a), IsInterrupted t False, SyncUnlock a\<rbrace>
va = RetVal Unit
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>wait([]),?h\<rangle> -\<lbrace>(UnlockFail, ?a)\<rbrace>\<rightarrow>ext \<langle>RetEXC IllegalMonitorState,?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
case RedNotify
[PROOF STATE]
proof (state)
this:
M = notify
vs = []
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
va = RetVal Unit
h' = h

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>Notify a, Unlock\<rightarrow>a, Lock\<rightarrow>a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
let ?ta' = "\<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "\<not> has_lock (locks s $ a) t"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t
[PROOF STEP]
by(fastforce simp add: lock_actions_ok'_iff finfun_upd_apply wset_actions_ok_def Cons_eq_append_conv split: if_split_asm dest: may_lock_t_may_lock_unlock_lock_t has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
from RedNotify
[PROOF STATE]
proof (chain)
picking this:
M = notify
vs = []
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
va = RetVal Unit
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = notify
vs = []
ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
va = RetVal Unit
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (12 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 12 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
case RedNotifyFail
[PROOF STATE]
proof (state)
this:
M = notify
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
note ta = \<open>ta = \<lbrace>UnlockFail\<rightarrow>a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
let ?ta' = "\<lbrace>Notify a, Unlock\<rightarrow>a, Lock\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "has_lock (locks s $ a) t"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. has_lock (locks s $ a) t
[PROOF STEP]
by(auto simp add: finfun_upd_apply split: if_split_asm)
[PROOF STATE]
proof (state)
this:
has_lock (locks s $ a) t

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
hence "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
[PROOF STEP]
by(auto simp add: finfun_upd_apply simp add: wset_actions_ok_def intro: has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace> ta

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace> ta

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
from RedNotifyFail
[PROOF STATE]
proof (chain)
picking this:
M = notify
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = notify
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (11 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notify; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
A total of 11 subgoals...
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
final_thread.actions_subset \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>
final_thread.actions_subset \<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>Notify a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case RedNotifyAll
[PROOF STATE]
proof (state)
this:
M = notifyAll
vs = []
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
va = RetVal Unit
h' = h

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
note ta = \<open>ta = \<lbrace>NotifyAll a, Unlock\<rightarrow>a, Lock\<rightarrow>a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>UnlockFail\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "\<not> has_lock (locks s $ a) t"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. \<not> has_lock (locks s $ a) t
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply wset_actions_ok_def Cons_eq_append_conv split: if_split_asm dest: may_lock_t_may_lock_unlock_lock_t)
[PROOF STATE]
proof (state)
this:
\<not> has_lock (locks s $ a) t

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
hence "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
\<not> has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
by(auto simp add: lock_actions_ok'_iff finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedNotifyAll
[PROOF STATE]
proof (chain)
picking this:
M = notifyAll
vs = []
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
va = RetVal Unit
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = notifyAll
vs = []
ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
va = RetVal Unit
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (10 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 10. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>(UnlockFail, a)\<rbrace>
final_thread.actions_subset \<lbrace>(UnlockFail, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>(UnlockFail, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case RedNotifyAllFail
[PROOF STATE]
proof (state)
this:
M = notifyAll
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
note ta = \<open>ta = \<lbrace>UnlockFail\<rightarrow>a\<rbrace>\<close>
[PROOF STATE]
proof (state)
this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>NotifyAll a, Unlock\<rightarrow>a, Lock\<rightarrow>a\<rbrace>"
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta False None
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None
[PROOF STEP]
have "has_lock (locks s $ a) t"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
\<not> final_thread.actions_ok' s t ta
wset s t = None

goal (1 subgoal):
 1. has_lock (locks s $ a) t
[PROOF STEP]
by(auto simp add: finfun_upd_apply split: if_split_asm)
[PROOF STATE]
proof (state)
this:
has_lock (locks s $ a) t

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
hence "final_thread.actions_ok' s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
[PROOF STEP]
using None
[PROOF STATE]
proof (prove)
using this:
has_lock (locks s $ a) t
wset s t = None

goal (1 subgoal):
 1. final_thread.actions_ok' s t \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
[PROOF STEP]
by(auto simp add: finfun_upd_apply wset_actions_ok_def intro: has_lock_may_lock)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok' s t \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from ta
[PROOF STATE]
proof (chain)
picking this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>
[PROOF STEP]
have "final_thread.actions_subset ?ta' ta"
[PROOF STATE]
proof (prove)
using this:
ta = \<lbrace>(UnlockFail, a)\<rbrace>

goal (1 subgoal):
 1. final_thread.actions_subset \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace> ta
[PROOF STEP]
by(auto simp add: collect_locks'_def finfun_upd_apply)
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace> ta

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_subset \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace> ta

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedNotifyAllFail
[PROOF STATE]
proof (chain)
picking this:
M = notifyAll
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
using this:
M = notifyAll
vs = []
ta = \<lbrace>(UnlockFail, a)\<rbrace>
va = RetEXC IllegalMonitorState
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(fastforce)
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (9 subgoals):
 1. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = notifyAll; vs = []; ta = \<lbrace>(UnlockFail, a)\<rbrace>; va = RetEXC IllegalMonitorState; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 9. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok' s t \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
final_thread.actions_subset \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok' s t \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>
final_thread.actions_subset \<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace> ta
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>NotifyAll a, (Unlock, a), (Lock, a)\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case RedInterruptedTrue
[PROOF STATE]
proof (state)
this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetVal (Bool True)
h' = h

goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>IsInterrupted t False\<rbrace>"
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedInterruptedTrue
[PROOF STATE]
proof (chain)
picking this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetVal (Bool True)
h' = h
[PROOF STEP]
have "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetVal (Bool True)
h' = h

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted t False\<rbrace>
[PROOF STEP]
using None False
[PROOF STATE]
proof (prove)
using this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetVal (Bool True)
h' = h
wset s t = None
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted t False\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t False\<rbrace>

goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t False\<rbrace>

goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RedInterruptedFalse RedInterruptedTrue
[PROOF STATE]
proof (prove)
using this:
?P,?t \<turnstile> \<langle>?a\<bullet>interrupted([]),?h\<rangle> -\<lbrace>IsInterrupted ?t False\<rbrace>\<rightarrow>ext \<langle>RetVal (Bool False),?h\<rangle>
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
va = RetVal (Bool True)
h' = h

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (8 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>; va = RetVal (Bool True); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 8. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t False\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t False\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t False\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
case RedInterruptedFalse
[PROOF STATE]
proof (state)
this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t False\<rbrace>
va = RetVal (Bool False)
h' = h

goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
let ?ta' = "\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>"
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
from RedInterruptedFalse
[PROOF STATE]
proof (chain)
picking this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t False\<rbrace>
va = RetVal (Bool False)
h' = h
[PROOF STEP]
have "final_thread.actions_ok final s t ?ta'"
[PROOF STATE]
proof (prove)
using this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t False\<rbrace>
va = RetVal (Bool False)
h' = h

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
using None False
[PROOF STATE]
proof (prove)
using this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t False\<rbrace>
va = RetVal (Bool False)
h' = h
wset s t = None
\<not> final_thread.actions_ok' s t ta

goal (1 subgoal):
 1. final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
[PROOF STEP]
by(auto simp add: final_thread.actions_ok_iff final_thread.cond_action_oks.simps)
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>

goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
obtain va h' where "P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -?ta'\<rightarrow>ext \<langle>va,h'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using RedInterruptedFalse RedInterruptedTrue
[PROOF STATE]
proof (prove)
using this:
M = interrupted
vs = []
ta = \<lbrace>IsInterrupted t False\<rbrace>
va = RetVal (Bool False)
h' = h
?P,?t \<turnstile> \<langle>?a\<bullet>interrupted([]),?h\<rangle> -\<lbrace>IsInterrupted ?t True, ClearInterrupt ?t, ObsInterrupted ?t\<rbrace>\<rightarrow>ext \<langle>RetVal (Bool True),?h\<rangle>

goal (1 subgoal):
 1. (\<And>va h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (7 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = interrupted; vs = []; ta = \<lbrace>IsInterrupted t False\<rbrace>; va = RetVal (Bool False); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 7. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
final_thread.actions_ok final s t \<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>
P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -\<lbrace>IsInterrupted t True, ClearInterrupt t, ObsInterrupted t\<rbrace>\<rightarrow>ext \<langle>va,h'\<rangle>

goal (1 subgoal):
 1. \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal (6 subgoals):
 1. \<And>obs a'. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = (K$ [], [], [], [], [], obs); va = RetVal (Addr a'); heap_clone P h a h' \<lfloor>(obs, a')\<rfloor>\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 2. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = clone; vs = []; ta = \<lbrace>\<rbrace>; va = RetEXC OutOfMemory; heap_clone P h a h' None\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 3. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = hashcode; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Intg (word_of_int (hash_addr a))); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 4. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = print; ta = \<lbrace>ExternalCall a print vs Unit\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 5. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = currentThread; vs = []; ta = \<lbrace>\<rbrace>; va = RetVal (Addr (thread_id2addr t)); h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
 6. \<lbrakk>\<not> final_thread.actions_ok' s t ta; M = yield; vs = []; ta = \<lbrace>Yield\<rbrace>; va = RetVal Unit; h' = h\<rbrakk> \<Longrightarrow> \<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)
[PROOF STEP]
qed(auto simp add: None)
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>ta' va' h'. P,t \<turnstile> \<langle>a\<bullet>M(vs),h\<rangle> -ta'\<rightarrow>ext \<langle>va',h'\<rangle> \<and> (final_thread.actions_ok final s t ta' \<or> final_thread.actions_ok' s t ta' \<and> final_thread.actions_subset ta' ta)

goal:
No subgoals!
[PROOF STEP]
qed