#|
 Copyright (C) 1987, 1994 by William R. Bevier.  All Rights Reserved.
 You may copy and distribute verbatim copies of this Nqthm-1992 event script as
 you receive it, in any medium, including embedding it verbatim in derivative
 works, provided that you conspicuously and appropriately publish on each copy
 a valid copyright notice "Copyright (C) 1987, 1994 by William R. Bevier.  All
 Rights Reserved."
 NO WARRANTY
 William R. Bevier PROVIDES ABSOLUTELY NO WARRANTY.  THE EVENT SCRIPT IS
 PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED,
 INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND
 FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND
 PERFORMANCE OF THE SCRIPT IS WITH YOU.  SHOULD THE SCRIPT PROVE DEFECTIVE, YOU
 ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
 IN NO EVENT WILL William R. Bevier BE LIABLE TO YOU FOR ANY DAMAGES, ANY LOST
 PROFITS, LOST MONIES, OR OTHER SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
 ARISING OUT OF THE USE OR INABILITY TO USE THIS SCRIPT (INCLUDING BUT NOT
 LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED
 BY THIRD PARTIES), EVEN IF YOU HAVE ADVISED US OF THE POSSIBILITY OF SUCH
 DAMAGES, OR FOR ANY CLAIM BY ANY OTHER PARTY.''
|#
;
; Kit Script for NQTHM-1992
; Bill Bevier
; Computational Logic, Inc.
; bevier@cli.com
;
; This script is derived from the original Kit proof script. The
; original script contains the events entered by the author, and
; extends over some 62 files. The original runs on a version of NQTHM
; modified by the author to handle deftheory events and hints, and to
; handle opening up of constant functions in a certain way.
;
; This script was derived by replaying the original in PC-NQTHM, and
; simultaneously writing out a translation of each event that would
; allow the script to play in NQTHM-1992. The main differences between
; the events which appear here and those in the original are:
;

;   1. Constant expressions are expanded in place here. The body of no
;      definition or lemma is modified from the original other than the
;      replacement of a constant expression by its value.
;   2. A few extra deftheory events and enable-theory hints are
;      required in this script, primarily for controlling *1* functions.
;

Event: Start with the initial nqthm theory.

Theorem: plus-right-id2 (y ∉ N) → ((x + y) = fix (x))

Event: Disable plus-right-id2.

Theorem: plus-add1 (x + (1 + y)) = if y ∈ N then 1 + (x + y)

else 1 + x endif

Event: Disable plus-add1.

Theorem: commutativity2-of-plus (x + (y + z)) = (y + (x + z))

Event: Disable commutativity2-of-plus.

Theorem: commutativity-of-plus (x + y) = (y + x)

Event: Disable commutativity-of-plus.

Theorem: associativity-of-plus ((x + y) + z) = (x + (y + z))

Event: Disable associativity-of-plus.

Theorem: plus-equal-0 ((a + b) = '0) = ((a ≃ 0) ∧ (b ≃ 0))

Event: Disable plus-equal-0.

Theorem: difference-x-x (x − x) = '0

Event: Disable difference-x-x.

Theorem: difference-plus (((x + y) − x) = fix (y)) ∧ (((y + x) − x) = fix (y))

Event: Disable difference-plus.

Theorem: plus-cancellation ((a + b) = (a + c)) = (fix (b) = fix (c))

Event: Disable plus-cancellation.

Theorem: difference-0 (y ≮ x) → ((x − y) = '0)

Event: Disable difference-0.

Theorem: equal-difference-0 ('0 = (x − y)) = (y ≮ x)

Event: Disable equal-difference-0.

Theorem: difference-cancellation-0 (x = (x − y)) = ((x ∈ N) ∧ ((x = '0) ∨ (y ≃ 0)))

Event: Disable difference-cancellation-0.

Theorem: difference-cancellation-1 ((x − y) = (z − y)) = if x < y then y ≮ z

elseif z < y then y ≮ x else fix (x) = fix (z) endif

Event: Disable difference-cancellation-1.

Theorem: times-zero2 (y ∉ N) → ((x ∗ y) = '0)

Event: Disable times-zero2.

Theorem: distributivity-of-times-over-plus (x ∗ (y + z)) = ((x ∗ y) + (x ∗ z))

Event: Disable distributivity-of-times-over-plus.

Theorem: times-add1 (x ∗ (1 + y)) = if y ∈ N then x + (x ∗ y)

else fix (x) endif

Event: Disable times-add1.

Theorem: commutativity-of-times (x ∗ y) = (y ∗ x)

Event: Disable commutativity-of-times.

Theorem: commutativity2-of-times (x ∗ (y ∗ z)) = (y ∗ (x ∗ z))

Event: Disable commutativity2-of-times.

Theorem: associativity-of-times ((x ∗ y) ∗ z) = (x ∗ (y ∗ z))

Event: Disable associativity-of-times.

Theorem: equal-times-0 ((x ∗ y) = '0) = ((x ≃ 0) ∨ (y ≃ 0))

Event: Disable equal-times-0.

Definition: exp (i, j ) = if j ≃ 0 then '1

else i ∗ exp (i, j − 1) endif

Theorem: exp-plus exp (i, j + k) = (exp (i, j ) ∗ exp (i, k))

Event: Disable exp-plus.

Theorem: equal-lessp ((x < y) = z) = if x < y then '*1*true = z

else '*1*false = z endif

Event: Disable equal-lessp.

Theorem: difference-elim ((y ∈ N) ∧ (y ≮ x)) → ((x + (y − x)) = y)

Theorem: remainder-quotient ((x mod y) + (y ∗ (x ÷ y))) = fix (x)

Event: Disable remainder-quotient.

Theorem: remainder-wrt-1 (y mod '1) = '0

Event: Disable remainder-wrt-1.

Theorem: remainder-wrt-12 (x ∉ N) → ((y mod x) = fix (y))

Event: Disable remainder-wrt-12.

Theorem: lessp-remainder2 ((x mod y) < y) = (y ≄ 0)

Event: Disable lessp-remainder2.

Theorem: remainder-x-x (x mod x) = '0

Event: Disable remainder-x-x.

Theorem: remainder-quotient-elim ((y ≄ 0) ∧ (x ∈ N)) → (((x mod y) + (y ∗ (x ÷ y))) = x)

Theorem: lessp-times-1 (i ≄ 0) → ((i ∗ j ) ≮ j )

Event: Disable lessp-times-1.

Theorem: lessp-times-2 (i ≄ 0) → ((j ∗ i) ≮ j ) Event: Disable lessp-times-2.

Theorem: lessp-quotient1 ((i ÷ j ) < i) = ((i ≄ 0) ∧ ((j ≃ 0) ∨ (j ≠ '1))) Event: Disable lessp-quotient1.

Theorem: lessp-remainder1 ((x mod y) < x) = ((y ≄ 0) ∧ ((x ≄ 0) ∧ (x ≮ y))) Event: Disable lessp-remainder1.

Theorem: difference-plus1 ((x + y) − x) = fix (y) Event: Disable difference-plus1.

Theorem: difference-plus2 ((y + x) − x) = fix (y) Event: Disable difference-plus2.

Theorem: difference-plus-cancelation ((x + y) − (x + z)) = (y − z) Event: Disable difference-plus-cancelation.

Theorem: times-difference (x ∗ (c − w)) = ((c ∗ x) − (w ∗ x)) Event: Disable times-difference.

Definition: divides (x, y) = ((y mod x) ≃ 0) Theorem: divides-times ((x ∗ z) mod z) = '0 Event: Disable divides-times.

Theorem: difference-plus3 ((b + (a + c)) − a) = (b + c)

Event: Disable difference-plus3.

Theorem: difference-add1-cancellation ((1 + (y + z)) − z) = (1 + y)

Event: Disable difference-add1-cancellation.

Theorem: remainder-add1 ((y ≄ 0) ∧ (y ≠ '1)) → (((1 + (x ∗ y)) mod y) ≠ '0)

Event: Disable remainder-add1.

Theorem: divides-plus-rewrite1 (((x mod z) = '0) ∧ ((y mod z) = '0)) → (((x + y) mod z) = '0)

Event: Disable divides-plus-rewrite1.

Theorem: divides-plus-rewrite2 (((x mod z) = '0) ∧ ((y mod z) ≠ '0)) → (((x + y) mod z) ≠ '0)

Event: Disable divides-plus-rewrite2.

Theorem: divides-plus-rewrite ((x mod z) = '0) → ((((x + y) mod z) = '0) = ((y mod z) = '0))

Event: Disable divides-plus-rewrite.

Theorem: lessp-plus-cancelation ((x + y) < (x + z)) = (y < z)

Event: Disable lessp-plus-cancelation.

Theorem: divides-plus-rewrite-commuted ((x mod z) = '0) → ((((y + x) mod z) = '0) = ((y mod z) = '0))

Event: Disable divides-plus-rewrite-commuted.

Theorem: euclid ((x mod z) = '0) → ((((y − x) mod z) = '0)

= if x < y then (y mod z) = '0 else '*1*true endif)

Event: Disable euclid.

Theorem: lessp-times-cancellation ((x ∗ z) < (y ∗ z)) = ((z ≄ 0) ∧ (x < y))

Event: Disable lessp-times-cancellation.

Theorem: lessp-plus-cancellation3 (y < (x + y)) = (x ≄ 0)

Event: Disable lessp-plus-cancellation3.

Theorem: quotient-times1 ((y ∈ N) ∧ ((x ∈ N) ∧ ((x ≠ '0) ∧ divides (x, y)))) → ((x ∗ (y ÷ x)) = y)

Event: Disable quotient-times1.

Theorem: quotient-lessp ((x ≄ 0) ∧ (x < y)) → ((y ÷ x) ≠ '0)

Event: Disable quotient-lessp.

Theorem: times-id-iff-1 (z = (w ∗ z)) = ((z ∈ N) ∧ ((z = '0) ∨ (w = '1)))

Event: Disable times-id-iff-1.

Theorem: divides-times1 (a = (z ∗ y)) → ((a mod z) = '0)

Event: Disable divides-times1.

Theorem: times-identity1 ((y ∈ N) ∧ ((y ≠ '1) ∧ ((y ≠ '0) ∧ (x ≠ '0)))) → (x ≠ (x ∗ y))

Event: Disable times-identity1.

Theorem: times-identity (x = (x ∗ y)) = ((x = '0) ∨ ((x ∈ N) ∧ (y = '1)))

Event: Disable times-identity.

Theorem: quotient-divides ((y ∈ N) ∧ ((x ∗ (y ÷ x)) ≠ y)) → ((y mod x) ≠ '0)

Event: Disable quotient-divides.

Theorem: remainder-times ((y ∗ x) mod y) = '0

Event: Disable remainder-times.

Theorem: quotient-times ((y ∗ x) ÷ y) = if y ≃ 0 then '0

else fix (x) endif

Event: Disable quotient-times.

Theorem: distributivity-of-divides ((a ≄ 0) ∧ divides (a, w)) → ((c ∗ (w ÷ a)) = ((c ∗ w) ÷ a))

Event: Disable distributivity-of-divides.

Theorem: if-times-then-divides ((c ≄ 0) ∧ (¬ divides (c, x))) → ((c ∗ y) ≠ x)

Event: Disable if-times-then-divides.

Theorem: times-equal-1 ((a ∗ b) = '1) = ((a ≠ '0)

∧ ((b ≠ '0)

∧ ((a ∈ N)
∧ ((b ∈ N)

∧ (((a − 1) = '0) ∧ ((b − 1) = '0))))))

Event: Disable times-equal-1.

Theorem: divides-implies-times ((a ≄ 0) ∧ ((c ∈ N) ∧ ((a ∗ c) = b))) → ((c = (b ÷ a)) = '*1*true)

Event: Disable divides-implies-times.

Theorem: difference-1 (x − '1) = (x − 1)

Event: Disable difference-1.

Theorem: difference-2 ((1 + (1 + x)) − '2) = fix (x)

Event: Disable difference-2.

Theorem: half-plus ((x + (x + y)) ÷ '2) = (x + (y ÷ '2))

Event: Disable half-plus.

Theorem: times-1 ('1 ∗ x) = fix (x)

Event: Disable times-1.

Theorem: exp-of-0 exp ('0, k) = if k ≃ 0 then '1

else '0 endif

Event: Disable exp-of-0.

Theorem: exp-of-1 exp ('1, k) = '1 Event: Disable exp-of-1.

Theorem: exp-by-0 exp (x, '0) = '1

Event: Disable exp-by-0.

Theorem: exp-times exp (i ∗ j , k) = (exp (i, k) ∗ exp (j , k))

Event: Disable exp-times.

Theorem: exp-exp exp (exp (i, j ), k) = exp (i, j ∗ k)

Event: Disable exp-exp.

Theorem: remainder-plus-times-1 ((x + (i ∗ j )) mod j ) = (x mod j )

Event: Disable remainder-plus-times-1.

Theorem: remainder-plus-times-2 ((x + (j ∗ i)) mod j ) = (x mod j )

Event: Disable remainder-plus-times-2.

Theorem: remainder-times-1 ((b ∗ (a ∗ c)) mod a) = '0

Event: Disable remainder-times-1.

Theorem: remainder-of-1 ('1 mod x) = if x = '1 then '0

else '1 endif

Event: Disable remainder-of-1.

Theorem: remainder-difference-times (((p ∗ x) − (p ∗ y)) mod p) = '0 Event: Disable remainder-difference-times.

Theorem: lessp-remainder-divisor (y ≄ 0) → ((x mod y) < y)

Event: Disable lessp-remainder-divisor.

Event: Let us define the theory cl-arithmetic to consist of the following events: lessp-remainder-divisor, remainder-difference-times, remainder-of-1, remaindertimes-1, remainder-plus-times-2, remainder-plus-times-1, exp-exp, exp-times, exp-by-0, exp-of-1, exp-of-0, times-1, half-plus, difference-2, difference-1, dividesimplies-times, times-equal-1, if-times-then-divides, distributivity-of-divides, quotienttimes, remainder-times, quotient-divides, times-identity, times-identity1, dividestimes1, times-id-iff-1, quotient-lessp, quotient-times1, lessp-plus-cancellation3, lessp-times-cancellation, euclid, divides-plus-rewrite-commuted, lessp-plus-cancelation, divides-plus-rewrite, divides-plus-rewrite2, divides-plus-rewrite1, remainder-add1, difference-add1-cancellation, difference-plus3, divides-times, divides, times-difference, difference-plus-cancelation, difference-plus2, difference-plus1, lessp-remainder1, lessp-quotient1, lessp-times-2, lessp-times-1, remainder-quotient-elim, remainderx-x, lessp-remainder2, remainder-wrt-12, remainder-wrt-1, remainder-quotient, difference-elim, equal-lessp, exp-plus, equal-times-0, associativity-of-times, commutativity2of-times, commutativity-of-times, times-add1, distributivity-of-times-over-plus, times-zero2, difference-cancellation-1, difference-cancellation-0, equal-difference-0, difference-0, plus-cancellation, difference-plus, difference-x-x, plus-equal-0, associativity-of-plus, commutativity-of-plus, commutativity2-of-plus, plus-add1, plus-right-id2.

Definition: number-and-list-induction (n, l) = if n ≃ 0 then '0

elseif listp (l) then number-and-list-induction (n − 1, cdr (l))

else '0 endif

Definition: double-number-induction (x, y) = if (x ≃ 0) ∨ (y ≃ 0) then '0

else double-number-induction (x − 1, y − 1) endif

Definition: double-number-double-list-induction (i, j , l1 , l2 ) = if listp (l1 ) ∧ listp (l2 )

then if (i ≃ 0) ∨ (j ≃ 0) then '0 else double-number-double-list-induction (i − 1, j − 1, cdr (l1 ), cdr (l2 )) endif

else '0 endif

Theorem: plus-0 (a + '0) = fix (a)

Event: Disable plus-0.

Theorem: plus-1 ('1 + x) = (1 + x)

Event: Disable plus-1.

Theorem: plus-0-arg1 ('0 + x) = fix (x)

Event: Disable plus-0-arg1.

Theorem: plus-difference-cancellation

 if b < a then '*1*false

else '*1*true endif → ((a + (b − a)) = fix (b))

Event: Disable plus-difference-cancellation.

Theorem: canonicalize-plus-terms1 (1 + ((1 + a) + b)) = ((1 + (1 + a)) + b)

Event: Disable canonicalize-plus-terms1.

Theorem: canonicalize-plus-terms2 ((1 + a) + ((1 + b) + c)) = (((1 + a) + (1 + b)) + c)

Event: Disable canonicalize-plus-terms2.

Theorem: canonicalize-plus-terms3 ((a ∗ b) + ((1 + c) + d)) = ((1 + c) + (d + (a ∗ b)))

Event: Disable canonicalize-plus-terms3.

Theorem: plus-plus-difference ((i ∈ N) ∧ ((n ∈ N)

∧ if n < i then '*1*false else '*1*true endif))

→ ((i + (j + (n − i))) = (n + j ))

Event: Disable plus-plus-difference.

Theorem: plus-times-reduction (a + (b ∗ a)) = ((1 + b) ∗ a)

Event: Disable plus-times-reduction.

Theorem: plus-times-sub1-reduction (b ≄ 0) → ((a + ((b − 1) ∗ a)) = (b ∗ a))

Event: Disable plus-times-sub1-reduction.

Theorem: plus-commutativity-associativity-crock (b + (a + c)) = (a + (b + c))

Event: Disable plus-commutativity-associativity-crock.

Theorem: distributivity-of-times-over-plus-backwards ((a ∗ b) + (a ∗ c)) = (a ∗ (b + c))

Event: Disable distributivity-of-times-over-plus-backwards.

Theorem: difference-is-zero (a < b) → ((a − b) = '0)

Event: Disable difference-is-zero.

Theorem: difference-by-larger-number ((x − 1) − x) = '0

Event: Disable difference-by-larger-number.

Theorem: difference-add1-arg1

 if a < b then '*1*false

else '*1*true endif → (((1 + a) − b) = (1 + (a − b)))

Event: Disable difference-add1-arg1.

Theorem: difference-add1-arg2 (b < a) → ((a − (1 + b)) = ((a − b) − 1))

Event: Disable difference-add1-arg2.

Theorem: sub1-difference ((a − b) − 1) = ((a − 1) − b)

Event: Disable sub1-difference.

Theorem: difference-sub1-arg1 (b < a) → (((a − 1) − b) = ((a − b) − 1))

Event: Disable difference-sub1-arg1.

Theorem: difference-sub1-arg2 ((b ≄ 0) ∧ if a < b then '*1*false

else '*1*true endif) → ((a − (b − 1)) = (1 + (a − b)))

Event: Disable difference-sub1-arg2.

Theorem: difference-plus-cancellation2-instance

 if a < c then '*1*false

else '*1*true endif → ((((1 + a) + b) − (1 + c)) = ((a − c) + b))

Event: Disable difference-plus-cancellation2-instance.

Theorem: difference-difference ((a − b) − c) = (a − (b + c))

Event: Disable difference-difference.

Theorem: yet-another-difference-plus-crock ((n + (b + a)) − a) = (n + b)

Event: Disable yet-another-difference-plus-crock.

Theorem: non-zero-difference ((a ∈ N) ∧ (a < b)) → ((b − a) ≠ '0)

Event: Disable non-zero-difference.

Theorem: rewrite-non-zero-difference-as-lessp ((a − b) ≠ '0) = (b < a)

Event: Disable rewrite-non-zero-difference-as-lessp.

Theorem: rewrite-zero-difference-as-equality

 if a < b then '*1*false

else '*1*true endif → (((a − b) = '0) = (fix (a) = fix (b)))

Event: Disable rewrite-zero-difference-as-equality.

Theorem: regroup-fact (if a < c then '*1*false else '*1*true endif ∧ if b < d then '*1*false

else '*1*true endif) → (((a + b) − (c + d)) = ((a − c) + (b − d)))

Event: Disable regroup-fact.

Theorem: difference-equals-0 ((a ∈ N) ∧ ((b ∈ N)

∧ if a < b then '*1*false else '*1*true endif))

→ (((a − b) = '0) = (a = b))

Event: Disable difference-equals-0.

Theorem: times-zero3 (x ∗ '0) = '0

Event: Disable times-zero3.

Theorem: distributivity-of-times-over-difference ((a ∗ b) − (a ∗ c)) = (a ∗ (b − c))

Event: Disable distributivity-of-times-over-difference.

Theorem: exp-2-never-0

 ('0 < exp ('2, i)) = '*1*true

Event: Disable exp-2-never-0.

Theorem: exp-2-never-0-linear '0 < exp ('2, i)

Event: Disable exp-2-never-0-linear.

Theorem: remainder-noop ((a ∈ N) ∧ ((a < b) ∧ (b ≄ 0))) → ((a mod b) = a)

Event: Disable remainder-noop.

Theorem: remainder-add1-casesplit (a < b) → (((1 + a) mod b)

= if (1 + a) = b then '0 else 1 + a endif)

Event: Disable remainder-add1-casesplit.

Theorem: zerop-remainder-difference ((a mod b) = '0) → (((a − b) mod b) = '0)

Event: Disable zerop-remainder-difference.

Theorem: quotient-x-x (x ≄ 0) → ((x ÷ x) = '1)

Event: Disable quotient-x-x.

Theorem: remainder-times-other-way ((b ∗ a) mod a) = '0

Event: Disable remainder-times-other-way.

Theorem: quotient-times-other-way ((b ∗ a) ÷ a) = if a ≃ 0 then '0

else fix (b) endif

Event: Disable quotient-times-other-way.

Theorem: quotient-difference (i ≮ j ) → (((i − j ) ÷ j ) = ((i ÷ j ) − 1))

Event: Disable quotient-difference.

Theorem: quotient-plus (a ≄ 0) → (((a + b) ÷ a) = (1 + (b ÷ a)))

Event: Disable quotient-plus.

Theorem: quotient-plus-times (c < b) → (((c + (b ∗ a)) ÷ b) = fix (a))

Event: Disable quotient-plus-times.

Theorem: leq-times ((a ≄ 0) ∧ if c < b then '*1*false

else '*1*true endif) → if (a ∗ c) < (a ∗ b) then '*1*false

else '*1*true endif

Theorem: lessp-remainder-sub1-crock (x < n) → ((x − 1) < n)

Theorem: leq-plus if c < (a + b) then '*1*false else '*1*true endif → if c < a then '*1*false

else '*1*true endif

Theorem: leq-plus1 if c < (a + b) then '*1*false else '*1*true endif → (if c < a then '*1*false

else '*1*true endif

∧ if c < b then '*1*false else '*1*true endif)

Theorem: leq-plus2 if c < (a + b) then '*1*false else '*1*true endif

→ ((c < a) = '*1*false)

Theorem: leq-casesplit ((a ∈ N) ∧ (b ∈ N)) → (if b < a then '*1*false

else '*1*true endif = ((a < b) ∨ (a = b)))

Theorem: integer-inequality-casesplit ((i ∈ N) ∧ (j ∈ N)) → ((i ≠ j ) = ((i < j ) ∨ (j < i)))

Theorem: integer-equality-crock ((a ∈ N) ∧ ((b ∈ N) ∧ ((a < '1) ∧ (b < '1)))) → (a = b)

Theorem: lessp-remainder-remainder ((c ≄ 0) ∧ ((b mod c) ≄ 0)) → (((a mod (b mod c)) < c) = '*1*true)

Event: Disable lessp-remainder-remainder.

Theorem: lessp-times ((a ≄ 0) ∧ (b < c)) → ((a ∗ b) < (a ∗ c))

Event: Disable lessp-times.

Theorem: leq-plus-times ((b < c) ∧ (a ≄ 0)) → if (a ∗ c) < (a + (a ∗ b)) then '*1*false

else '*1*true endif

Theorem: lessp-difference ((a ≄ 0) ∧ (a < b)) → ((b − a) < b)

Theorem: remainder-difference-non-zero ((a ≄ 0) ∧ ((b ∈ N) ∧ (a < b))) → (((b − a) mod b) ≄ 0)

Event: Disable remainder-difference-non-zero.

Theorem: sum-zero-implies-addends-zero ((a + b) = '0) → ((a ≃ 0) ∧ (b ≃ 0))

Theorem: remainder-zero-implies-leq-fact (((a mod b) = '0) ∧ (a ≄ 0)) → ((a < b) = '*1*false)

Event: Disable remainder-zero-implies-leq-fact.

Definition: lessp-quotient-induction (a, b, c) = if b ≃ 0 then '0

elseif c ≃ 0 then '0 elseif a < c then '0 else lessp-quotient-induction (a − c, b − 1, c) endif

Theorem: lessp-quotient-remainder-crock ((a < (b ∗ c)) ∧ ((b ≠ '0)

∧ ((b ∈ N) ∧ ((c ≠ '0) ∧ ((c ∈ N) ∧ (a ∈ N)))))) → ((a ÷ c) < b)

Event: Disable lessp-quotient-remainder-crock.

Theorem: lessp-quotient-remainder ((b ≄ 0) ∧ (c ≄ 0)) → (((a mod (b ∗ c)) ÷ c) < fix (b))

Event: Disable lessp-quotient-remainder.

Theorem: lessp-quotient-times (a < (b ∗ c)) → (((a ÷ c) < b) = '*1*true)

Event: Disable lessp-quotient-times.

Definition: min (a, b) = if a < b then a

else b endif

Theorem: lessp-transitivity ((a < b) ∧ (b < c)) → (a < c)

Theorem: remainder-plus ((a + n) mod a) = (n mod a)

Event: Disable remainder-plus.

Theorem: remainder-divides (divides (a, u) ∧ (u ∈ N)) → (((u + n) mod a) = (n mod a))

Event: Disable remainder-divides.

Theorem: remainder-remainder divides (a, b) → (((n mod b) mod a) = (n mod a))

Event: Disable remainder-remainder.

Theorem: lessp-quotient (n < (a ∗ b)) → ((n ÷ a) < b)

Definition: lessp-quotient-quotient-induction (n, a, b) = if n ≃ 0 then '0

elseif a < n then '0 elseif b < n then '0 else lessp-quotient-quotient-induction (n, a − n, b − n) endif

Theorem: lessp-quotient-quotient ((n ≄ 0) ∧ (((b mod n) = '0) ∧ (a < b))) → (((a ÷ n) < (b ÷ n)) = '*1*true)

Event: Disable lessp-quotient-quotient.

Theorem: lessp-times-quotient ((n ≄ 0) ∧ ((i ∈ N) ∧ ((i < j ) ∧ ((j mod n) = '0)))) → (((n ∗ (i ÷ n)) < j ) = '*1*true)

Event: Disable lessp-times-quotient.

Theorem: not-lessp-times-plus ((a ∈ N) ∧ ((v ∈ N)

∧ ((v < n)

∧ ((b ∈ N)
∧ ((n ≠ '0)
∧ ((n ∈ N)
∧ ((v + (a ∗ n))
< (b ∗ n))))))))

→ ((b ∗ n) ≮ ((a ∗ n) + n))

Theorem: not-lessp-times-plus-instance ((x ∈ N) ∧ ((v ∈ N)

∧ ((v < n)

∧ ((z ∈ N)
∧ ((n ≠ '0)
∧ ((n ∈ N)
∧ ((n ∗ z)
< (n + (n ∗ x)))))))))

→ (((v + (n ∗ x)) < (n ∗ z)) = '*1*false)

Event: Disable not-lessp-times-plus-instance.

Theorem: not-lessp-plus-times-quotient ((n ≄ 0) ∧ ((i ∈ N) ∧ ((i < j ) ∧ ((j mod n) = '0)))) → ((j < ((n ∗ (i ÷ n)) + n)) = '*1*false)

Event: Disable not-lessp-plus-times-quotient.

Theorem: quotient-plus-times-remainder (n ≄ 0) → ((((n ∗ a) + (b mod n)) ÷ n) = fix (a))

Event: Disable quotient-plus-times-remainder.

Theorem: remainder-plus-times-remainder (((n ∗ a) + (b mod n)) mod n) = (b mod n)

Event: Disable remainder-plus-times-remainder.

Theorem: remainder-non-zero ((n ≄ 0) ∧ (n < m)) → ('0 < (n mod m))

Theorem: plus-not-equal (fix (b) ≠ fix (c)) → ((a + b) ≠ (a + c))

Event: Disable plus-not-equal.

Theorem: difference-plus4 ((a + (b + c)) − (b + c)) = fix (a)

Event: Disable difference-plus4.

Theorem: remainder-remainder-inverse divides (a, b) → ((n mod a) = ((n mod b) mod a))

Theorem: associativity-of-plus-inverse (a + (b + c)) = ((a + b) + c)

Definition: length (l) = if listp (l) then 1 + length (cdr (l))

else '0 endif

Definition: insert (i, l) = if listp (l)

then if i < car (l) then cons (i, l)

else cons (car (l), insert (i, cdr (l))) endif else cons (i, l) endif

Definition: occurrences (x, l) = if listp (l)

then if x = car (l) then 1 + occurrences (x, cdr (l))

else occurrences (x, cdr (l)) endif else '0 endif

Definition: remove (x, l) = if listp (l)

then if x = car (l) then cdr (l)

else cons (car (l), remove (x, cdr (l))) endif else l endif

Definition: permutation (a, b) = if listp (a)

then (car (a) ∈ b) ∧ permutation (cdr (a), remove (car (a), b)) else b ≃ nil endif

Definition: plistp (l) = if listp (l) then plistp (cdr (l))

else l = 'nil endif

Definition: setp (l) = if listp (l) then (car (l) ∉ cdr (l)) ∧ setp (cdr (l))

else l = 'nil endif Definition: sorted (l) = if listp (l)

then if listp (cdr (l))

then if car (cdr (l)) < car (l) then '*1*false

else sorted (cdr (l)) endif else '*1*true endif

else '*1*true endif

Theorem: not-listp-remove (¬ listp (l)) → (¬ listp (remove (x, cons (x, l))))

Event: Disable not-listp-remove.

Theorem: length-insert length (insert (i, l)) = (1 + length (l))

Event: Disable length-insert.

Theorem: length-remove length (remove (x, l)) = if x ∈ l then length (l) − 1

else length (l) endif

Event: Disable length-remove.

Theorem: length-permutation permutation (a, b) → (length (a) = length (b))

Theorem: number-of-occurrences-of-set-member-is-1 (setp (l) ∧ (x ∈ l)) → (occurrences (x, l) = '1)

Theorem: plistp-remove plistp (remove (x, l)) = plistp (l)

Event: Disable plistp-remove.

Theorem: plistp-set setp (l) → plistp (l)

Event: Disable plistp-set.

Theorem: insert-remove (sorted (l) ∧ (x ≠ y)) → (insert (x, remove (y, l)) = remove (y, insert (x, l)))

Event: Disable insert-remove.

Theorem: member-insert (x ∈ l) → (x ∈ insert (i, l))

Event: Disable member-insert.

Theorem: not-member-insert ((x ∉ l) ∧ (i ≠ x)) → (x ∉ insert (i, l))

Event: Disable not-member-insert.

Theorem: member-remove1 (x ∈ remove (y, l)) → (x ∈ l)

Theorem: member-remove2 ((x ∈ l) ∧ (x ≠ y)) → (x ∈ remove (y, l))

Event: Disable member-remove2.

Theorem: not-member-remove1 setp (l) → (x ∉ remove (x, l))

Event: Disable not-member-remove1.

Theorem: not-member-remove2 (x ∉ l) → (x ∉ remove (y, l))

Event: Disable not-member-remove2.

Theorem: not-member-permutation (permutation (a, b) ∧ (x ∉ b)) → (x ∉ a)

Theorem: member-permutation (permutation (a, b) ∧ (x ∈ b)) → (x ∈ a)

Theorem: remove-remove (x ≠ y) → (remove (y, remove (x, l)) = remove (x, remove (y, l)))

Event: Disable remove-remove.

Theorem: sorted-insert (sorted (l) ∧ (i ∉ l)) → sorted (insert (i, l))

Event: Disable sorted-insert.

Theorem: sorted-remove sorted (l) → sorted (remove (x, l))

Event: Disable sorted-remove.

Theorem: not-permutation (listp (b) ∧ (car (b) ∉ a)) → (¬ permutation (a, b))

Event: Disable not-permutation.

Theorem: permutation-right-cons1 (listp (b) ∧ (car (b) ∈ a)) → (permutation (a, b) = permutation (remove (car (b), a), cdr (b)))

Event: Disable permutation-right-cons1.

Theorem: permutation-right-cons permutation (a, cons (x, b)) = if x ∈ a then permutation (remove (x, a), b)

    else '*1*false endif

Event: Disable permutation-right-cons.

Theorem: commutativity-of-permutation permutation (b, a) = permutation (a, b)

Event: Disable commutativity-of-permutation.

Theorem: member-permutation2 (permutation (b, a) ∧ (x ∈ b)) → (x ∈ a)

Theorem: permutation-reflexivity permutation (l, l)

Event: Disable permutation-reflexivity.

Theorem: permutation-append-car permutation (append (l, cons (x, 'nil)), cons (x, l))

Event: Disable permutation-append-car.

Theorem: permutation-append-insert (permutation (a, b) ∧ (sorted (b) ∧ ((x ∉ a) ∧ (x ∉ b)))) → permutation (append (a, cons (x, 'nil)), insert (x, b))

Event: Disable permutation-append-insert.

Theorem: permutation-remove-remove (permutation (a, b) ∧ ((x ∈ a) ∧ (x ∈ b))) → permutation (remove (x, a), remove (x, b))

Event: Disable permutation-remove-remove.

Definition: transitivity-of-permutation-induction (a, b, c) = if listp (a)

then transitivity-of-permutation-induction (cdr (a), remove (car (a), b), remove (car (a), c))

else '0 endif

Theorem: transitivity-of-permutation-base-case ((a ≃ nil) ∧ (permutation (a, b) ∧ permutation (b, c))) → permutation (a, c)

Theorem: transitivity-of-permutation-induction-step (listp (a) ∧ (((permutation (cdr (a), remove (car (a), b))

∧ permutation (remove (car (a), b), remove (car (a), c))) → permutation (cdr (a), remove (car (a), c))) ∧ (permutation (a, b) ∧ permutation (b, c))))

→ permutation (a, c)

Theorem: transitivity-of-permutation (permutation (a, b) ∧ permutation (b, c)) → permutation (a, c)

Theorem: setp-remove setp (a) → setp (remove (x, a))

Event: Disable setp-remove.

Definition: setp-permutation-induction (a, b) = if listp (a) then setp-permutation-induction (cdr (a), remove (car (a), b))

else '0 endif Theorem: setp-permutation-base-case ((¬ listp (a)) ∧ plistp (a)) → setp (a)

Theorem: setp-permutation-induction-step (listp (a) ∧ (setp (b)

∧ (plistp (a)

∧ (permutation (a, b)

∧ ((setp (remove (car (a), b)) ∧ (plistp (cdr (a))

∧ permutation (cdr (a),

remove (car (a), b))))

→ setp (cdr (a)))))))

→ setp (a)

Theorem: setp-permutation (setp (b) ∧ (plistp (a) ∧ permutation (a, b))) → setp (a)

Theorem: setp-insert (setp (l) ∧ (i ∉ l)) → setp (insert (i, l))

Event: Disable setp-insert.

Definition: getnth (n, l) = if listp (l)

then if n ≃ 0 then car (l)

else getnth (n − 1, cdr (l)) endif else '0 endif

Definition: putnth (v, n, l) = if listp (l)

then if n ≃ 0 then cons (v, cdr (l))

else cons (car (l), putnth (v, n − 1, cdr (l))) endif else l endif

Definition: getseg (n, k, l) = if k ≃ 0 then 'nil

else cons (getnth (n, l), getseg (1 + n, k − 1, l)) endif

Definition: putseg (s, n, l) = if listp (s) then putnth (car (s), n, putseg (cdr (s), 1 + n, l))

else l endif Definition: fixlength (n, l, default) = if listp (l)

then if n ≃ 0 then 'nil

else cons (car (l), fixlength (n − 1, cdr (l), default)) endif elseif n ≃ 0 then 'nil else cons (default, fixlength (n − 1, l, default)) endif

Definition: firstn (n, l) = if listp (l)

then if n ≃ 0 then 'nil

else cons (car (l), firstn (n − 1, cdr (l))) endif else 'nil endif

Definition: nthcdr (n, l) = if listp (l)

then if n ≃ 0 then l

else nthcdr (n − 1, cdr (l)) endif else l endif

Theorem: non-zero-length-implies-listp (length (l) ≄ 0) → listp (l)

Event: Disable non-zero-length-implies-listp.

Theorem: listp-implies-non-zero-length listp (l) → (length (l) ≠ '0)

Event: Disable listp-implies-non-zero-length.

Theorem: plist-of-non-zero-length-is-a-list (plistp (a) ∧ (length (a) ≠ '0)) → listp (a)

Event: Disable plist-of-non-zero-length-is-a-list.

Theorem: listp-append listp (append (a, b)) = (listp (a) ∨ listp (b))

Event: Disable listp-append.

Theorem: listp-append-left listp (a) → listp (append (a, b))

Event: Disable listp-append-left.

Theorem: listp-getseg (k ≄ 0) → listp (getseg (n, k, l))

Event: Disable listp-getseg.

Theorem: listp-putnth listp (putnth (v, n, l)) = listp (l)

Event: Disable listp-putnth.

Theorem: listp-putseg listp (putseg (s, n, l)) = listp (l)

Event: Disable listp-putseg.

Theorem: rewrite-car-to-getnth-0 car (l) = getnth ('0, l)

Event: Disable rewrite-car-to-getnth-0.

Theorem: car-append-casesplit car (append (a, b)) = if listp (a) then car (a)

else car (b) endif

Event: Disable car-append-casesplit.

Theorem: car-append listp (a) → (car (append (a, b)) = car (a))

Event: Disable car-append.

Theorem: car-getseg (k ≄ 0) → (car (getseg (n, k, l)) = getnth (n, l))

Event: Disable car-getseg.

Theorem: car-putnth-zero (listp (l) ∧ (n ≃ 0)) → (car (putnth (v, n, l)) = v)

Event: Disable car-putnth-zero.

Theorem: car-putseg-zero ((n ≃ 0) ∧ (listp (s) ∧ listp (l))) → (car (putseg (s, n, l)) = car (s))

Event: Disable car-putseg-zero.

Theorem: cdr-append cdr (append (a, b)) = if listp (a) then append (cdr (a), b)

else cdr (b) endif

Event: Disable cdr-append.

Theorem: cdr-getseg (k ≄ 0) → (cdr (getseg (n, k, l)) = getseg (1 + n, k − 1, l))

Event: Disable cdr-getseg.

Theorem: cdr-is-nil-when-length-is-1 (plistp (l) ∧ (length (l) = '1)) → ((cdr (l) = 'nil) = '*1*true)

Event: Disable cdr-is-nil-when-length-is-1.

Theorem: plist-of-length-0 (plistp (l) ∧ (length (l) = '0)) → ((l = 'nil) = '*1*true)

Event: Disable plist-of-length-0.

Theorem: plistp-append plistp (b) → plistp (append (a, b))

Event: Disable plistp-append.

Theorem: plistp-list1 plistp (cons (x, 'nil))

Event: Disable plistp-list1.

Theorem: plistp-list2 plistp (cons (x, cons (y, 'nil)))

Event: Disable plistp-list2. Theorem: plistp-putnth plistp (l) → plistp (putnth (v, i, l)) Event: Disable plistp-putnth. Theorem: plistp-getseg plistp (getseg (n, k, l)) Event: Disable plistp-getseg. Theorem: plistp-putseg plistp (l) → plistp (putseg (s, n, l)) Event: Disable plistp-putseg. Theorem: plistp-fixlength plistp (fixlength (n, l, v)) Event: Disable plistp-fixlength. Theorem: length-append length (append (a, b)) = (length (a) + length (b)) Event: Disable length-append. Theorem: length-putnth length (putnth (n, v, l)) = length (l) Event: Disable length-putnth. Theorem: length-getseg length (getseg (n, k, l)) = fix (k) Event: Disable length-getseg. Theorem: length-putseg length (putseg (s, n, l)) = length (l) Event: Disable length-putseg.

Theorem: length-fixlength length (fixlength (n, l, default)) = fix (n)

Event: Disable length-fixlength.

Theorem: append-non-list-left (¬ listp (a)) → (append (a, b) = b)

Event: Disable append-non-list-left.

Theorem: append-non-list-left-corollary (length (a) = '0) → (append (a, b) = b)

Event: Disable append-non-list-left-corollary.

Theorem: append-nil-on-right plistp (a) → (append (a, 'nil) = a)

Event: Disable append-nil-on-right.

Theorem: append-cdr listp (a) → (append (cdr (a), b) = cdr (append (a, b)))

Event: Disable append-cdr.

Theorem: append-crock append (cons (a, 'nil), append (b, c)) = append (cons (a, b), c)

Event: Disable append-crock.

Theorem: associativity-of-append append (append (a, b), c) = append (a, append (b, c))

Event: Disable associativity-of-append.

Theorem: append-fixlength append (fixlength (a, 'nil, default), fixlength (b, 'nil, default)) = fixlength (a + b, 'nil, default)

Event: Disable append-fixlength.

Theorem: getnth-0-2 getnth ('0, cons (a, cons (b, 'nil))) = a Event: Disable getnth-0-2.

Theorem: getnth-1-2 getnth ('1, cons (a, cons (b, 'nil))) = b

Event: Disable getnth-1-2.

Theorem: list-getnth-0 (plistp (l) ∧ (length (l) = '1)) → (cons (getnth ('0, l), 'nil) = l)

Event: Disable list-getnth-0.

Theorem: open-up-getnth getnth (1 + n, cons (a, b)) = getnth (n, b)

Event: Disable open-up-getnth.

Theorem: open-up-getnth1 (n ≄ 0) → (getnth (n, cons (a, b)) = getnth (n − 1, b))

Event: Disable open-up-getnth1.

Theorem: open-up-getnth-on-zero getnth ('0, cons (a, b)) = a

Event: Disable open-up-getnth-on-zero.

Theorem: getnth-with-non-number-index (n ∉ N) → (getnth (n, l) = getnth ('0, l))

Event: Disable getnth-with-non-number-index.

Theorem: getnth-append-for-length-left getnth (length (a), append (a, b)) = if listp (b) then car (b)

else '0 endif

Event: Disable getnth-append-for-length-left.

Theorem: getnth-append-casesplit getnth (n, append (a, b)) = if n < length (a) then getnth (n, a)

else getnth (n − length (a), b) endif Event: Disable getnth-append-casesplit.

Theorem: getnth-append-right if n < length (a) then '*1*false else '*1*true endif → (getnth (n, append (a, b)) = getnth (n − length (a), b))

Event: Disable getnth-append-right.

Theorem: getnth-append-left (n < length (a)) → (getnth (n, append (a, b)) = getnth (n, a))

Event: Disable getnth-append-left.

Theorem: getnth-putnth-casesplit getnth (i, putnth (v, j , l)) = if i < length (l)

then if fix (i) = fix (j ) then v else getnth (i, l) endif

else getnth (i, l) endif

Event: Disable getnth-putnth-casesplit.

Theorem: getnth-putnth-coincidence (n < length (l)) → (getnth (n, putnth (v, n, l)) = v)

Event: Disable getnth-putnth-coincidence.

Theorem: getnth-putnth-non-interference (fix (i) ≠ fix (j )) → (getnth (i, putnth (v, j , l)) = getnth (i, l))

Event: Disable getnth-putnth-non-interference.

Theorem: getnth-getseg-zero-index ((k ≄ 0) ∧ (i ≃ 0)) → (getnth (i, getseg (n, k, l)) = getnth (n, l))

Event: Disable getnth-getseg-zero-index.

Definition: getnth-getseg-induction (i, n, k) = if (i ≃ 0) ∨ (k ≃ 0) then '0

else getnth-getseg-induction (i − 1, 1 + n, k − 1) endif Theorem: getnth-getseg (i < k) → (getnth (i, getseg (n, k, l)) = getnth (n + i, l))

Event: Disable getnth-getseg.

Theorem: getnth-getseg-inverse (i < k) → (getnth (n + i, l) = getnth (i, getseg (n, k, l)))

Event: Disable getnth-getseg-inverse.

Theorem: getnth-after-putseg if i < (n + length (s)) then '*1*false else '*1*true endif → (getnth (i, putseg (s, n, l)) = getnth (i, l))

Event: Disable getnth-after-putseg.

Theorem: getnth-before-putseg (i < n) → (getnth (i, putseg (s, n, l)) = getnth (i, l))

Event: Disable getnth-before-putseg.

Theorem: getnth-putseg-coincidence (if i < n then '*1*false else '*1*true endif ∧ (((i − n) < length (s)) ∧ (i < length (l)))) → (getnth (i, putseg (s, n, l)) = getnth (i − n, s))

Event: Disable getnth-putseg-coincidence.

Theorem: open-putnth-casesplit putnth (v, n, cons (a, b)) = if n ≃ 0 then cons (v, b)

else cons (a, putnth (v, n − 1, b)) endif

Event: Disable open-putnth-casesplit.

Theorem: open-up-putnth1 (n ≄ 0) → (putnth (v, n, cons (a, b)) = cons (a, putnth (v, n − 1, b)))

Event: Disable open-up-putnth1.

Theorem: putnth-into-nil putnth (v, i, 'nil) = 'nil

Event: Disable putnth-into-nil.

Theorem: open-up-putnth-on-zero putnth (val, '0, cons (a, b)) = cons (val, b)

Event: Disable open-up-putnth-on-zero.

Theorem: putnth-with-non-number-index (i ∉ N) → (putnth (v, i, l) = putnth (v, '0, l))

Event: Disable putnth-with-non-number-index.

Theorem: putnth-has-no-effect (n ≮ length (l)) → (putnth (v, n, l) = l)

Event: Disable putnth-has-no-effect.

Theorem: putnth-cons1 (n ≃ 0) → (putnth (v, n, cons (a, b)) = cons (v, b))

Event: Disable putnth-cons1.

Theorem: putnth-cons2 (n ≄ 0) → (putnth (v, n, cons (a, b)) = cons (a, putnth (v, n − 1, b)))

Event: Disable putnth-cons2.

Theorem: putnth-shift (i < length (l)) → (putnth (v, i, l) = append (firstn (i, l), cons (v, nthcdr (1 + i, l))))

Event: Disable putnth-shift.

Theorem: putnth-append-casesplit putnth (v, n, append (a, b)) = if n < length (a) then append (putnth (v, n, a), b)

else append (a, putnth (v, n − length (a), b)) endif

Event: Disable putnth-append-casesplit.

Theorem: putnth-append-right if n < length (a) then '*1*false else '*1*true endif → (putnth (v, n, append (a, b)) = append (a, putnth (v, n − length (a), b)))

Event: Disable putnth-append-right.

Theorem: putnth-append-left (n < length (a)) → (putnth (v, n, append (a, b)) = append (putnth (v, n, a), b))

Event: Disable putnth-append-left.

Theorem: putnth-getnth-coincidence putnth (getnth (i, l), i, l) = l

Event: Disable putnth-getnth-coincidence.

Theorem: putnth-getnth-coincidence1 (getnth (i, l1 ) = getnth (i, l2 )) → (putnth (getnth (i, l1 ), i, putnth (v, i, l2 )) = l2 )

Event: Disable putnth-getnth-coincidence1.

Theorem: putnth-putnth-casesplit ((i ∈ N) ∧ ((j ∈ N)

∧ if j < i then '*1*false else '*1*true endif))

→ (putnth (b, j , putnth (a, i, l))

= if i = j then putnth (b, j , l) else putnth (a, i, putnth (b, j , l)) endif)

Event: Disable putnth-putnth-casesplit.

Theorem: putnth-coincidence (fix (i) = fix (j )) → (putnth (b, j , putnth (a, i, l)) = putnth (b, j , l))

Event: Disable putnth-coincidence.

Theorem: putnth-non-interference (fix (i) ≠ fix (j )) → (putnth (b, j , putnth (a, i, l)) = putnth (a, i, putnth (b, j , l)))

Theorem: putnth-non-interference-corollary1 (fix (i) < (1 + j )) → (putnth (b, 1 + j , putnth (a, i, l)) = putnth (a, i, putnth (b, 1 + j , l)))

Event: Disable putnth-non-interference-corollary1.

Theorem: putnth-non-interference-corollary2 (fix (i) < (j + k)) → (putnth (b, j + k, putnth (a, i, l)) = putnth (a, i, putnth (b, j + k, l)))

Event: Disable putnth-non-interference-corollary2.

Theorem: putnth-putseg-coincidence-proof ((n ∈ N) ∧ ((i ∈ N)

∧ (if i < n then '*1*false else '*1*true endif ∧ ((i − n) < length (s)))))

→ (putnth (v, i, putseg (s, n, l)) = putseg (putnth (v, i − n, s), n, l))

Event: Disable putnth-putseg-coincidence-proof.

Theorem: putseg-with-non-number-index (n ∉ N) → (putseg (s, n, l) = putseg (s, '0, l))

Event: Disable putseg-with-non-number-index.

Theorem: putnth-putseg-coincidence (if i < n then '*1*false else '*1*true endif ∧ ((i − n) < length (s))) → (putnth (v, i, putseg (s, n, l)) = putseg (putnth (v, i − n, s), n, l))

Event: Disable putnth-putseg-coincidence.

Theorem: putnth-putseg-coincidence-inverse ((i < length (s)) ∧ (i ∈ N)) → (putseg (putnth (v, i, s), n, l) = putnth (v, i + n, putseg (s, n, l)))

Event: Disable putnth-putseg-coincidence-inverse.

Theorem: putnth-after-putseg-proof ((i ∈ N) ∧ ((n ∈ N)

∧ (if i < n then '*1*false else '*1*true endif ∧ if (i − n) < length (s) then '*1*false

else '*1*true endif)))

→ (putnth (v, i, putseg (s, n, l)) = putseg (s, n, putnth (v, i, l)))

Event: Disable putnth-after-putseg-proof.

Theorem: putnth-after-putseg (if i < n then '*1*false else '*1*true endif ∧ if (i − n) < length (s) then '*1*false

else '*1*true endif) → (putnth (v, i, putseg (s, n, l)) = putseg (s, n, putnth (v, i, l)))

Event: Disable putnth-after-putseg.

Theorem: getseg-of-length-zero (k ≃ 0) → (getseg (n, k, l) = 'nil)

Event: Disable getseg-of-length-zero.

Theorem: getseg-add1-length getseg (n, 1 + k, l) = append (getseg (n, k, l), cons (getnth (n + k, l), 'nil))

Event: Disable getseg-add1-length.

Theorem: getseg-with-non-number-index (n ∉ N) → (getseg (n, k, l) = getseg ('0, k, l))

Event: Disable getseg-with-non-number-index.

Theorem: getseg-add1-cons getseg (1 + n, k, cons (a, b)) = getseg (n, k, b)

Event: Disable getseg-add1-cons.

Theorem: getseg-length-1 getseg (n, '1, l) = cons (getnth (n, l), 'nil)

Theorem: getseg-length-1-rule (k = '1) → (getseg (n, k, l) = cons (getnth (n, l), 'nil))

Event: Disable getseg-length-1-rule.

Theorem: getseg-add1-length2 ((n ∈ N) ∧ if length (l) < (1 + n) then '*1*false

else '*1*true endif) → (getseg (n, 1 + k, l) = cons (getnth (n, l), getseg (1 + n, k, l)))

Event: Disable getseg-add1-length2.

Theorem: getseg-append-right if n < length (a) then '*1*false else '*1*true endif → (getseg (n, k, append (a, b)) = getseg (n − length (a), k, b))

Event: Disable getseg-append-right.

Theorem: getseg-across-append ((n ∈ N) ∧ (if length (a) < n then '*1*false

else '*1*true endif

∧ if (n + k) < length (a) then '*1*false

else '*1*true endif))

→ (getseg (n, k, append (a, b))

= append (getseg (n, length (a) − n, a), getseg ('0, k − (length (a) − n), b)))

Event: Disable getseg-across-append.

Theorem: getseg-append-left if length (a) < (n + k) then '*1*false else '*1*true endif → (getseg (n, k, append (a, b)) = getseg (n, k, a))

Event: Disable getseg-append-left.

Theorem: getseg-after-putnth (n < i) → (getseg (i, k, putnth (v, n, l)) = getseg (i, k, l))

Event: Disable getseg-after-putnth.

Theorem: getseg-before-putnth if n < (i + k) then '*1*false else '*1*true endif → (getseg (i, k, putnth (v, n, l)) = getseg (i, k, l))

Event: Disable getseg-before-putnth.

Theorem: getseg-putnth-coincidence (if n < i then '*1*false else '*1*true endif ∧ (((n − i) < k) ∧ (n < length (l)))) → (getseg (i, k, putnth (v, n, l)) = putnth (v, n − i, getseg (i, k, l)))

Event: Disable getseg-putnth-coincidence.

Definition: integer-induction-instance (n, k) = if k ≃ 0 then '0

else integer-induction-instance (1 + n, k − 1) endif

Theorem: getseg-getseg if k < (i + j ) then '*1*false else '*1*true endif → (getseg (i, j , getseg (n, k, l)) = getseg (n + i, j , l))

Event: Disable getseg-getseg.

Theorem: getseg-after-putseg if i < (n + length (s)) then '*1*false else '*1*true endif → (getseg (i, k, putseg (s, n, l)) = getseg (i, k, l))

Event: Disable getseg-after-putseg.

Theorem: getseg-before-putseg if n < (i + k) then '*1*false else '*1*true endif → (getseg (i, k, putseg (s, n, l)) = getseg (i, k, l))

Event: Disable getseg-before-putseg.

Theorem: getseg-within-putseg (if i < n then '*1*false else '*1*true endif ∧ (if length (l) < (n + length (s)) then '*1*false

else '*1*true endif

∧ if (n + length (s)) < (i + k) then '*1*false

else '*1*true endif))

→ (getseg (i, k, putseg (s, n, l)) = getseg (i − n, k, s))

Event: Disable getseg-within-putseg.

Definition: getseg-putseg-induction (i, k, s, n) = if k ≃ 0 then '0

elseif listp (s)

then getseg-putseg-induction (1 + i, k − 1, cdr (s), 1 + n)

else '0 endif

Theorem: putseg-has-no-effect (n ≮ length (l)) → (putseg (s, n, l) = l)

Event: Disable putseg-has-no-effect.

Theorem: putseg-cons2 (n ≄ 0) → (putseg (s, n, cons (a, b)) = cons (a, putseg (s, n − 1, b)))

Event: Disable putseg-cons2.

Theorem: getseg-around-putseg-proof ((i ∈ N) ∧ ((n ∈ N)

∧ (if n < i then '*1*false else '*1*true endif ∧ (if length (l) < (n + length (s)) then '*1*false

else '*1*true endif

∧ if (i + k) < (n + length (s))

                 then '*1*false

else '*1*true endif))))

→ (getseg (i, k, putseg (s, n, l)) = putseg (s, n − i, getseg (i, k, l)))

Event: Disable getseg-around-putseg-proof.

Theorem: numberp-casesplit (a ∈ N) ∨ (a ∉ N)

Theorem: getseg-around-putseg (if n < i then '*1*false else '*1*true endif ∧ (if length (l) < (n + length (s)) then '*1*false

else '*1*true endif

∧ if (i + k) < (n + length (s)) then '*1*false

else '*1*true endif))

→ (getseg (i, k, putseg (s, n, l)) = putseg (s, n − i, getseg (i, k, l)))

Event: Disable getseg-around-putseg.

Theorem: putseg-nil-segment putseg ('nil, n, l) = l

Event: Disable putseg-nil-segment.

Theorem: putseg-non-list-segment (¬ listp (s)) → (putseg (s, n, l) = l)

Event: Disable putseg-non-list-segment.

Theorem: open-up-putseg-on-segment-cons ((n ∈ N) ∧ if length (l) < (n + length (cons (a, b))) then '*1*false

else '*1*true endif) → (putseg (cons (a, b), n, l) = putnth (a, n, putseg (b, '1 + n, l)))

Event: Disable open-up-putseg-on-segment-cons.

Theorem: putseg-cons1 ((n ≃ 0) ∧ listp (s)) → (putseg (s, n, cons (a, b)) = cons (car (s), putseg (cdr (s), n, b)))

Event: Disable putseg-cons1.

Theorem: putseg-getseg-coincidence (i = n) → (putseg (getseg (n, k, l), i, l) = l)

Event: Disable putseg-getseg-coincidence.

Theorem: equality-of-getnth-backchain-proof (if i < n then '*1*false else '*1*true endif ∧ (((i − n) < k) ∧ (getseg (n, k, l1 ) = getseg (n, k, l2 )))) → (getnth (i, l1 ) = getnth (i, l2 ))

Definition: nested-intervals (n1 , k1 , n2 , k2 ) = (if n2 < n1 then '*1*false

else '*1*true endif

∧ if (n1 + k1 ) < (n2 + k2 ) then '*1*false else '*1*true endif)

Definition: strange-induction (a, b, c, d) = if (a ≃ 0) ∨ (b ≃ 0) then '0

else strange-induction (a − 1, b − 1, 1 + c, 1 + d) endif

Theorem: plus-arg2-must-be-zero (if i < n then '*1*false else '*1*true endif ∧ if n < (i + j ) then '*1*false

else '*1*true endif) → (j ≃ 0)

Event: Disable plus-arg2-must-be-zero.

Theorem: getseg-must-be-nil (if i < n then '*1*false else '*1*true endif ∧ if n < (i + j ) then '*1*false

else '*1*true endif) → (getseg (i, j , l) = 'nil)

Event: Disable getseg-must-be-nil.

Theorem: equality-of-getseg-backchain-base-case (((j ≃ 0) ∨ (k ≃ 0)) ∧ ((i ∈ N)

∧ ((n ∈ N)

∧ (nested-intervals (n, k, i, j )

∧ (getseg (n, k, l1 ) = getseg (n, k, l2 ))))))

→ (getseg (i, j , l1 ) = getseg (i, j , l2 ))

Theorem: equality-of-getseg-backchain-induction-step-case1 ((i ∈ N)

∧ ((n ∈ N)

∧ ((j ≄ 0)

∧ ((k ≄ 0)

∧ (((nested-intervals (1 + n, k − 1, 1 + i, j − 1)

∧ (getseg (1 + n, k − 1, l1 )

= getseg (1 + n, k − 1, l2 ))) → (getseg (1 + i, j − 1, l1 )

= getseg (1 + i, j − 1, l2 ))) ∧ (nested-intervals (n, k, i, j ) ∧ ((getseg (n, k, l1 )

= getseg (n, k, l2 )) ∧ (i = n))))))))

→ (getseg (i, j , l1 ) = getseg (i, j , l2 ))

Theorem: equality-of-getseg-backchain-induction-step-case2 ((i ∈ N) ∧ ((n ∈ N)

∧ ((j ≄ 0)

∧ ((k ≄ 0)

∧ (((nested-intervals (1 + n, k − 1, 1 + i, j − 1)

∧ (getseg (1 + n, k − 1, l1 )

= getseg (1 + n, k − 1, l2 ))) → (getseg (1 + i, j − 1, l1 )

= getseg (1 + i, j − 1, l2 ))) ∧ (nested-intervals (n, k, i, j ) ∧ ((getseg (n, k, l1 )

= getseg (n, k, l2 )) ∧ (n < i))))))))

→ (getseg (i, j , l1 ) = getseg (i, j , l2 ))

Theorem: equality-of-getseg-backchain-induction-step ((i ∈ N) ∧ ((n ∈ N)

∧ ((j ≄ 0)

∧ ((k ≄ 0)

∧ (((nested-intervals (1 + n, k − 1, 1 + i, j − 1)

∧ (getseg (1 + n, k − 1, l1 )

= getseg (1 + n, k − 1, l2 ))) → (getseg (1 + i, j − 1, l1 )

= getseg (1 + i, j − 1, l2 ))) ∧ (nested-intervals (n, k, i, j ) ∧ (getseg (n, k, l1 )

= getseg (n, k, l2 ))))))))

→ (getseg (i, j , l1 ) = getseg (i, j , l2 ))

Theorem: equality-of-getseg-backchain-proof ((i ∈ N) ∧ ((n ∈ N)

∧ (nested-intervals (n, k, i, j )

∧ (getseg (n, k, l1 ) = getseg (n, k, l2 )))))

→ (getseg (i, j , l1 ) = getseg (i, j , l2 ))

Theorem: equality-of-getseg-backchain (nested-intervals (n, k, i, j ) ∧ (getseg (n, k, l1 ) = getseg (n, k, l2 ))) → (getseg (i, j , l1 ) = getseg (i, j , l2 ))

Definition: getnth2 (i, j , l) = getnth (j , getnth (i, l))

Definition: putnth2 (v, i, j , l) = putnth (putnth (v, j , getnth (i, l)), i, l)

Theorem: plistp-putnth2 plistp (l) → plistp (putnth2 (v, i, j , l))

Event: Disable plistp-putnth2.

Theorem: length-putnth2 length (putnth2 (v, i, j , l)) = length (l)

Event: Disable length-putnth2.

Theorem: getnth-putnth-coincidence1 ((fix (i) = fix (j )) ∧ (i < length (l))) → (getnth (i, putnth (v, j , l)) = v)

Event: Disable getnth-putnth-coincidence1.

Theorem: getnth2-putnth2-coincidence ((i < length (l)) ∧ (j < length (getnth (i, l)))) → (getnth2 (i, j , putnth2 (v, i, j , l)) = v)

Event: Disable getnth2-putnth2-coincidence.

Theorem: getnth2-putnth2-non-interference1 (fix (i) ≠ fix (x)) → (getnth2 (i, j , putnth2 (v, x, y, l)) = getnth2 (i, j , l))

Event: Disable getnth2-putnth2-non-interference1.

Theorem: getnth2-putnth2-non-interference2 ((fix (i) = fix (x)) ∧ ((i < length (l)) ∧ (fix (j ) ≠ fix (y)))) → (getnth2 (i, j , putnth2 (v, x, y, l)) = getnth2 (i, j , l))

Event: Disable getnth2-putnth2-non-interference2.

Theorem: fixlength-of-length-0 (n ≃ 0) → (fixlength (n, l, x) = 'nil)

Event: Disable fixlength-of-length-0.

Theorem: fixlength-idempotence fixlength (n, fixlength (n, l, a), b) = fixlength (n, l, a)

Event: Disable fixlength-idempotence.

Theorem: fixlength-noop (plistp (l) ∧ (n = length (l))) → (fixlength (n, l, default) = l)

Event: Disable fixlength-noop.

Definition: reverse (l) = if listp (l) then append (reverse (cdr (l)), cons (car (l), 'nil))

else 'nil endif

Theorem: plistp-reverse plistp (reverse (a))

Event: Disable plistp-reverse.

Theorem: reverse-append reverse (append (a, b)) = append (reverse (b), reverse (a))

Event: Disable reverse-append.

Theorem: reverse-list1 reverse (cons (a, 'nil)) = cons (a, 'nil)

Event: Disable reverse-list1.

Theorem: reverse-list2 reverse (cons (a, cons (a, 'nil))) = cons (a, cons (a, 'nil))

Event: Disable reverse-list2.

Theorem: reverse-reverse plistp (l) → (reverse (reverse (l)) = l)

Event: Disable reverse-reverse.

Definition: finite-numberp (n, lub) = ((n ∈ N) ∧ (n < lub))

Definition: number-listp (l) = if listp (l) then (car (l) ∈ N) ∧ number-listp (cdr (l))

else '*1*true endif

Definition: finite-number-listp (l, lub) = if listp (l)

then finite-numberp (car (l), lub) ∧ finite-number-listp (cdr (l), lub) else '*1*true endif

Definition: non-zero-listp (l) = if listp (l) then (car (l) ≄ 0) ∧ non-zero-listp (cdr (l))

else '*1*true endif

Theorem: non-1-finite-number-is-zero (finite-numberp (a, '2) ∧ (a ≠ '1)) → (a = '0)

Theorem: finite-numberp-member (finite-number-listp (b, lub) ∧ (x ∈ b)) → finite-numberp (x, lub)

Event: Disable finite-numberp-member.

Theorem: a-finite-number-is-lessp-than-its-lub finite-numberp (n, lub) → ((n < lub) = '*1*true)

Event: Disable a-finite-number-is-lessp-than-its-lub.

Theorem: a-finite-number-is-a-number finite-numberp (n, lub) → (n ∈ N)

Theorem: finite-numberp-from-smaller-lub (finite-numberp (n, i) ∧ (i < j )) → finite-numberp (n, j )

Theorem: finite-number-sub1 finite-numberp (a, b) → finite-numberp (a − 1, b)

Event: Disable finite-number-sub1.

Theorem: finite-numberp-remainder (b ≄ 0) → finite-numberp (a mod b, b)

Event: Disable finite-numberp-remainder.

Theorem: a-finite-number-list-is-a-number-list finite-number-listp (l, lub) → number-listp (l)

Theorem: finite-numberp-getnth (finite-number-listp (l, lub) ∧ (i < length (l))) → finite-numberp (getnth (i, l), lub)

Event: Disable finite-numberp-getnth.

Theorem: numberp-getnth (finite-number-listp (l, lub) ∧ (i < length (l))) → (getnth (i, l) ∈ N)

Event: Disable numberp-getnth.

Theorem: lessp-getnth (finite-number-listp (l, lub) ∧ (i < length (l))) → ((getnth (i, l) < lub) = '*1*true)

Event: Disable lessp-getnth.

Theorem: lessp-getnth-linear (finite-number-listp (l, lub) ∧ (i < length (l))) → (getnth (i, l) < lub)

Event: Disable lessp-getnth-linear.

Theorem: element-of-non-zero-list-is-a-number (non-zero-listp (l) ∧ (i < length (l))) → (getnth (i, l) ∈ N)

Event: Disable element-of-non-zero-list-is-a-number.

Theorem: element-of-non-zero-list-is-non-zero (non-zero-listp (l) ∧ (i < length (l))) → (getnth (i, l) ≠ '0)

Event: Disable element-of-non-zero-list-is-non-zero.

Theorem: finite-number-listp-list finite-numberp (n, lub) → finite-number-listp (cons (n, 'nil), lub)

Event: Disable finite-number-listp-list.

Theorem: finite-number-listp-append (finite-number-listp (a, lub) ∧ finite-number-listp (b, lub)) → finite-number-listp (append (a, b), lub)

Event: Disable finite-number-listp-append.

Theorem: finite-number-listp-remove finite-number-listp (l, lub) → finite-number-listp (remove (x, l), lub)

Event: Disable finite-number-listp-remove.

Theorem: finite-number-listp-permutation (finite-number-listp (b, lub) ∧ permutation (a, b)) → finite-number-listp (a, lub)

Event: Disable finite-number-listp-permutation.

Theorem: finite-number-listp-putnth (finite-number-listp (l, lub) ∧ finite-numberp (v, lub)) → finite-number-listp (putnth (v, n, l), lub)

Event: Disable finite-number-listp-putnth.

Theorem: finite-number-listp-getseg (finite-number-listp (l, lub) ∧ if length (l) < (n + k) then '*1*false

else '*1*true endif) → finite-number-listp (getseg (n, k, l), lub)

Event: Disable finite-number-listp-getseg.

Theorem: finite-number-listp-putseg (finite-number-listp (l, lub) ∧ finite-number-listp (s, lub)) → finite-number-listp (putseg (s, n, l), lub)

Event: Disable finite-number-listp-putseg.

Theorem: finite-number-listp-fixlength (finite-number-listp (l, lub) ∧ finite-numberp (default, lub)) → finite-number-listp (fixlength (n, l, default), lub)

Event: Disable finite-number-listp-fixlength.

Theorem: finite-number-listp-for-zero-list (lub ≄ 0) → finite-number-listp (fixlength (n, 'nil, '0), lub)

Event: Disable finite-number-listp-for-zero-list.

Theorem: finite-number-listp-from-smaller-lub (finite-number-listp (l, i) ∧ (i < j )) → finite-number-listp (l, j )

Theorem: non-zero-listp-list (a ≄ 0) → non-zero-listp (cons (a, 'nil))

Event: Disable non-zero-listp-list.

Theorem: non-zero-listp-append (non-zero-listp (a) ∧ non-zero-listp (b)) → non-zero-listp (append (a, b))

Event: Disable non-zero-listp-append.

Theorem: non-zero-listp-putnth (non-zero-listp (l) ∧ (v ≄ 0)) → non-zero-listp (putnth (v, n, l))

Event: Disable non-zero-listp-putnth.

Theorem: non-zero-listp-getseg (non-zero-listp (l) ∧ if length (l) < (n + k) then '*1*false

else '*1*true endif) → non-zero-listp (getseg (n, k, l))

Event: Disable non-zero-listp-getseg.

Theorem: non-zero-listp-putseg (non-zero-listp (l) ∧ non-zero-listp (s)) → non-zero-listp (putseg (s, n, l))

Event: Disable non-zero-listp-putseg.

Theorem: non-zero-listp-fixlength (non-zero-listp (l) ∧ (default ≄ 0)) → non-zero-listp (fixlength (n, l, default))

Event: Disable non-zero-listp-fixlength.

Theorem: car-nthcdr (n < length (l)) → (car (nthcdr (n, l)) = getnth (n, l))

Event: Disable car-nthcdr.

Theorem: cdr-nthcdr (n < length (l)) → (cdr (nthcdr (n, l)) = nthcdr (1 + n, l))

Event: Disable cdr-nthcdr.

Theorem: listp-nthcdr (n < length (l)) → listp (nthcdr (n, l))

Event: Disable listp-nthcdr.

Theorem: plistp-firstn plistp (firstn (n, l))

Event: Disable plistp-firstn.

Theorem: plistp-nthcdr plistp (nthcdr (n, l)) = plistp (l)

Event: Disable plistp-nthcdr.

Theorem: length-firstn if length (l) < n then '*1*false else '*1*true endif → (length (firstn (n, l)) = fix (n))

Event: Disable length-firstn.

Theorem: length-nthcdr length (nthcdr (n, l)) = (length (l) − n)

Event: Disable length-nthcdr.

Theorem: firstn-zero (k ≃ 0) → (firstn (k, l) = 'nil)

Event: Disable firstn-zero.

Theorem: nthcdr-zero (n ≃ 0) → (nthcdr (n, l) = l)

Event: Disable nthcdr-zero.

Theorem: nthcdr-with-large-n (plistp (l) ∧ if n < length (l) then '*1*false

else '*1*true endif) → (nthcdr (n, l) = 'nil)

Event: Disable nthcdr-with-large-n.

Theorem: firstn-for-length (plistp (l) ∧ (n = length (l))) → (firstn (n, l) = l)

Event: Disable firstn-for-length.

Theorem: append-firstn-nthcdr append (firstn (i, l), nthcdr (i, l)) = l

Event: Disable append-firstn-nthcdr.

Theorem: firstn-firstn (i < n) → (firstn (i, firstn (n, l)) = firstn (i, l))

Event: Disable firstn-firstn.

Theorem: firstn-nthcdr plistp (l) → (firstn (length (l) − k, nthcdr (k, l)) = nthcdr (k, l))

Event: Disable firstn-nthcdr.

Theorem: nthcdr-append-right if n < length (a) then '*1*false else '*1*true endif → (nthcdr (n, append (a, b)) = nthcdr (n − length (a), b))

Event: Disable nthcdr-append-right.

Theorem: nthcdr-append-left if length (a) < n then '*1*false else '*1*true endif → (nthcdr (n, append (a, b)) = append (nthcdr (n, a), b))

Event: Disable nthcdr-append-left.

Definition: tablep (n, l) = if listp (l)

then plistp (car (l))

∧ ((length (car (l)) = n) ∧ tablep (n, cdr (l))) else l = 'nil endif

Theorem: length-of-nthcdr-goes-down (listp (l) ∧ (n ≄ 0)) → ((length (nthcdr (n, l)) < length (l)) = '*1*true)

Event: Disable length-of-nthcdr-goes-down.

Event: Enable length-of-nthcdr-goes-down.

Definition: table (n, l) = if n ≃ 0 then l

elseif listp (l) then cons (getseg ('0, n, l), table (n, nthcdr (n, l))) else 'nil endif

Event: Disable length-of-nthcdr-goes-down.

Definition: flatten (table) = if listp (table) then append (car (table), flatten (cdr (table)))

else 'nil endif

Theorem: plistp-table plistp (l) → plistp (table (n, l))

Event: Disable plistp-table.

Theorem: length-table ((n ≄ 0) ∧ ((length (l) mod n) = '0)) → (length (table (n, l)) = (length (l) ÷ n))

Event: Disable length-table.

Theorem: tablep-table (n ≄ 0) → tablep (n, table (n, l))

Event: Disable tablep-table.

Theorem: length-getnth-from-table (tablep (n, l) ∧ (i < length (l))) → (length (getnth (i, l)) = n)

Theorem: plistp-getnth-from-table (tablep (n, l) ∧ (i < length (l))) → plistp (getnth (i, l))

Theorem: length-getnth-table ((n ≄ 0) ∧ (((length (l) mod n) = '0) ∧ (i < (length (l) ÷ n)))) → (length (getnth (i, table (n, l))) = n)

Event: Disable length-getnth-table.

Theorem: plistp-getnth-table ((n ≄ 0) ∧ (((length (l) mod n) = '0) ∧ (i < (length (l) ÷ n)))) → plistp (getnth (i, table (n, l)))

Event: Disable plistp-getnth-table.

Theorem: getseg-equals-firstn-nthcdr (if length (l) < n then '*1*false else '*1*true endif ∧ if (length (l) − n) < k then '*1*false

else '*1*true endif) → (getseg (n, k, l) = firstn (k, nthcdr (n, l)))

Event: Disable getseg-equals-firstn-nthcdr.

Theorem: getseg-for-length (plistp (l) ∧ (k = length (l))) → (getseg ('0, k, l) = l)

Event: Disable getseg-for-length.

Theorem: plistp-flatten plistp (flatten (table))

Event: Disable plistp-flatten.

Theorem: length-flatten ((n ≄ 0) ∧ tablep (n, l)) → (length (flatten (l)) = (length (l) ∗ n))

Event: Disable length-flatten.

Theorem: table-append ((n ≄ 0) ∧ ((length (a) mod n) = '0)) → (table (n, append (a, b)) = append (table (n, a), table (n, b)))

Event: Disable table-append.

Theorem: nthcdr-for-length plistp (l) → (nthcdr (length (l), l) = 'nil)

Event: Disable nthcdr-for-length.

Theorem: table-for-length (plistp (l) ∧ (length (l) ≄ 0)) → (table (length (l), l) = cons (l, 'nil))

Event: Disable table-for-length.

Theorem: table-flatten ((n ≄ 0) ∧ tablep (n, table)) → (table (n, flatten (table)) = table)

Event: Disable table-flatten.

Theorem: listp-table (n ≄ 0) → (listp (table (n, l)) = listp (l))

Event: Disable listp-table.

Definition: integer-nthcdr-induction (i, n, l) = if n ≃ 0 then '0 elseif listp (l) then if i ≃ 0 then '0

else integer-nthcdr-induction (i − 1, n, nthcdr (n, l)) endif else '0 endif

Theorem: getnth-nthcdr getnth (i, nthcdr (n, l)) = getnth (n + i, l)

Event: Disable getnth-nthcdr.

Theorem: getseg-nthcdr-proof (i ∈ N) → (getseg (i, k, nthcdr (n, l)) = getseg (n + i, k, l))

Event: Disable getseg-nthcdr-proof.

Theorem: getseg-nthcdr getseg (i, k, nthcdr (n, l)) = getseg (n + i, k, l)

Event: Disable getseg-nthcdr.

Theorem: getnth-table (((i ∗ n) < length (l)) ∧ (n ≄ 0)) → (getnth (i, table (n, l)) = getseg (i ∗ n, n, l))

Event: Disable getnth-table.

Theorem: getnth-table-inverse (((i ∗ n) < length (l)) ∧ (n ≄ 0)) → (getseg (i ∗ n, n, l) = getnth (i, table (n, l)))

Event: Disable getnth-table-inverse.

Theorem: rewrite-getnth-from-table ((n ≄ 0) ∧ ((i < n)

∧ if length (l) < (n + (n ∗ j )) then '*1*false

else '*1*true endif))

→ (getnth (i + (n ∗ j ), l) = getnth (i, getnth (j , table (n, l))))

Event: Disable rewrite-getnth-from-table.

Theorem: rewrite-getnth-from-table0 ((n ≄ 0) ∧ if length (l) < (n + (n ∗ j )) then '*1*false

else '*1*true endif) → (getnth (n ∗ j , l) = getnth ('0, getnth (j , table (n, l))))

Event: Disable rewrite-getnth-from-table0.

Theorem: nthcdr-nthcdr nthcdr (i, nthcdr (j , l)) = nthcdr (j + i, l)

Event: Disable nthcdr-nthcdr.

Theorem: putnth-nthcdr putnth (v, i, nthcdr (n, l)) = nthcdr (n, putnth (v, n + i, l))

Event: Disable putnth-nthcdr.

Theorem: putseg-nthcdr-proof (i ∈ N) → (putseg (s, i, nthcdr (n, l)) = nthcdr (n, putseg (s, n + i, l)))

Event: Disable putseg-nthcdr-proof.

Theorem: putseg-nthcdr putseg (s, i, nthcdr (n, l)) = nthcdr (n, putseg (s, n + i, l))

Event: Disable putseg-nthcdr.

Theorem: nthcdr-putnth (n < i) → (nthcdr (i, putnth (v, n, l)) = nthcdr (i, l))

Event: Disable nthcdr-putnth.

Theorem: nthcdr-putseg if i < (n + length (s)) then '*1*false else '*1*true endif → (nthcdr (i, putseg (s, n, l)) = nthcdr (i, l))

Event: Disable nthcdr-putseg.

Theorem: table-putseg-subcase (plistp (s) ∧ ((length (s) ≄ 0)

∧ if length (l) < length (s) then '*1*false

else '*1*true endif))

→ (table (length (s), putseg (s, '0, l))

= cons (s, table (length (s), nthcdr (length (s), l))))

Event: Disable table-putseg-subcase.

Theorem: table-putseg (plistp (s) ∧ ((length (s) = n)

∧ ((n ≄ 0)

∧ if length (l) < ((n ∗ i) + length (s))

             then '*1*false

else '*1*true endif)))

→ (table (n, putseg (s, n ∗ i, l)) = putnth (s, i, table (n, l)))

Event: Disable table-putseg.

Theorem: table-putseg-inverse (plistp (s) ∧ ((length (s) = n)

∧ ((n ≄ 0)

∧ if length (l) < ((n ∗ i) + length (s))

             then '*1*false

else '*1*true endif)))

→ (putnth (s, i, table (n, l)) = table (n, putseg (s, n ∗ i, l)))

Event: Disable table-putseg-inverse.

Theorem: table-putnth ((n ≄ 0) ∧ ((i ∈ N) ∧ ((i < length (l)) ∧ ((length (l) mod n) = '0)))) → (table (n, putnth (v, i, l))

= putnth (putnth (v, i mod n, getnth (i ÷ n, table (n, l))), i ÷ n, table (n, l)))

Event: Disable table-putnth.

Definition: finite-number-tablep (n, l, lub) = if listp (l)

then plistp (car (l))

∧ (finite-number-listp (car (l), lub) ∧ ((length (car (l)) = n)

∧ finite-number-tablep (n, cdr (l), lub)))

else l = 'nil endif

Theorem: a-finite-number-table-is-a-table finite-number-tablep (n, l, lub) → tablep (n, l)

Event: Disable a-finite-number-table-is-a-table.

Theorem: finite-number-listp-nil finite-number-listp ('nil, lub)

Event: Disable finite-number-listp-nil.

Theorem: finite-number-listp-flatten ((n ≄ 0) ∧ finite-number-tablep (n, l, lub)) → finite-number-listp (flatten (l), lub)

Event: Disable finite-number-listp-flatten.

Theorem: finite-number-tablep-list (plistp (l) ∧ ((length (l) = n) ∧ finite-number-listp (l, lub))) → finite-number-tablep (n, cons (l, 'nil), lub)

Event: Disable finite-number-tablep-list.

Theorem: finite-number-tablep-append (finite-number-tablep (n, l1 , lub) ∧ finite-number-tablep (n, l2 , lub)) → finite-number-tablep (n, append (l1 , l2 ), lub)

Event: Disable finite-number-tablep-append.

Theorem: getnth-plus-1-is-cadr-nthcdr getnth ('1 + n, l) = car (cdr (nthcdr (n, l)))

Event: Disable getnth-plus-1-is-cadr-nthcdr.

Theorem: cadr-firstn ('1 < n) → (car (cdr (firstn (n, l))) = car (cdr (l)))

Event: Disable cadr-firstn.

Theorem: getnth-plus-1-is-cadr-getseg (('1 < k) ∧ (if length (l) < n then '*1*false

else '*1*true endif

∧ if (length (l) − n) < k then '*1*false

else '*1*true endif))

→ (getnth ('1 + n, l) = car (cdr (getseg (n, k, l))))

Theorem: getnth-plus-1-is-cadr-getseg-inverse (('1 < k) ∧ (if length (l) < n then '*1*false

else '*1*true endif

∧ if (length (l) − n) < k then '*1*false

else '*1*true endif))

→ (car (cdr (getseg (n, k, l))) = getnth ('1 + n, l))

Event: Disable getnth-plus-1-is-cadr-getseg-inverse.

Theorem: firstn-fixlength (if n < i then '*1*false else '*1*true endif ∧ if length (l) < i then '*1*false

else '*1*true endif) → (firstn (i, fixlength (n, l, default)) = firstn (i, l))

Event: Disable firstn-fixlength.

Theorem: getseg-fixlength (plistp (l) ∧ ((n ≄ 0) ∧ (length (l) < n))) → (getseg ('0, length (l), fixlength (n, l, default))

= getseg ('0, length (l), l))

Event: Disable getseg-fixlength.

Theorem: number-listp-finite-number-listp finite-number-listp (l, lub) → number-listp (l)

Definition: nonlast (l) = getseg ('0, length (l) − 1, l)

Theorem: length-nonlast length (nonlast (l)) = (length (l) − 1)

Event: Disable length-nonlast.

Theorem: plistp-nonlast plistp (nonlast (l))

Event: Disable plistp-nonlast.

Theorem: finite-number-listp-nonlast finite-number-listp (l, lub) → finite-number-listp (nonlast (l), lub)

Event: Disable finite-number-listp-nonlast.

Theorem: difference-sub1-plus-crock ((a ≄ 0) ∧ (b ≄ 0)) → ((((a + b) − 1) − a) = (b − 1))

Event: Disable difference-sub1-plus-crock.

Theorem: nonlast-append plistp (a) → (nonlast (append (a, b))

= if length (b) = '0 then nonlast (a) else append (a, nonlast (b)) endif)

Event: Disable nonlast-append.

Definition: incr-mod (n, lub) = if (1 + n) < lub then 1 + n

else '0 endif

Definition: decr-mod (n, lub) = if n ≃ 0 then lub − 1

else n − 1 endif

Theorem: decr-mod-size ((n ≄ 0) ∧ (a < n)) → (decr-mod (a, n) < n)

Event: Disable decr-mod-size.

Theorem: incr-mod-equals-remainder-add1 (n < lub) → (incr-mod (n, lub) = ((1 + n) mod lub))

Event: Disable incr-mod-equals-remainder-add1.

Theorem: incr-mod-decr-mod (n < lub) → (incr-mod (decr-mod (n, lub), lub) = fix (n)) Event: Disable incr-mod-decr-mod.

Theorem: lessp-incr-mod (n < lub) → (incr-mod (n, lub) < lub) Event: Disable lessp-incr-mod.

Definition: qfirst (table) = car (table) Definition: enq (item, table) = append (table, cons (item, 'nil)) Definition: deq (table) = cdr (table) Definition: qemptyp (table) = (length (table) = '0) Definition: qfullp (table, max) = (length (table) ≮ max) Definition: qreplace (item, queue) = enq (item, nonlast (queue)) Theorem: plistp-enq plistp (enq (item, l)) Event: Disable plistp-enq.

Theorem: plistp-deq (plistp (queue) ∧ (¬ qemptyp (queue))) → plistp (deq (queue)) Event: Disable plistp-deq.

Theorem: plistp-qreplace plistp (qreplace (item, queue)) Event: Disable plistp-qreplace.

Theorem: length-enq length (enq (item, queue)) = (1 + length (queue)) Event: Disable length-enq.

Theorem: length-non-empty-queue (¬ qemptyp (queue)) → (length (queue) ≠ '0)

Event: Disable length-non-empty-queue.

Theorem: length-deq (¬ qemptyp (queue)) → (length (deq (queue)) = (length (queue) − 1))

Event: Disable length-deq.

Theorem: length-qreplace (¬ qemptyp (queue)) → (length (qreplace (item, queue)) = length (queue))

Event: Disable length-qreplace.

Theorem: not-qemptyp-enq ¬ qemptyp (enq (item, queue))

Event: Disable not-qemptyp-enq.

Theorem: not-qfullp-deq (if n < length (queue) then '*1*false else '*1*true endif ∧ (¬ qemptyp (queue))) → (¬ qfullp (deq (queue), n))

Event: Disable not-qfullp-deq.

Theorem: qfirst-enq (¬ qemptyp (queue)) → (qfirst (enq (x, queue)) = qfirst (queue))

Event: Disable qfirst-enq.

Theorem: finite-number-listp-enq (finite-number-listp (queue, lub) ∧ finite-numberp (item, lub)) → finite-number-listp (enq (item, queue), lub)

Event: Disable finite-number-listp-enq.

Theorem: finite-number-listp-deq (finite-number-listp (queue, lub) ∧ (¬ qemptyp (queue))) → finite-number-listp (deq (queue), lub)

Event: Disable finite-number-listp-deq.

Theorem: finite-number-listp-qreplace (finite-number-listp (queue, lub) ∧ finite-numberp (item, lub)) → finite-number-listp (qreplace (item, queue), lub) Event: Disable finite-number-listp-qreplace.

Theorem: finite-numberp-qfirst (finite-number-listp (queue, lub) ∧ (¬ qemptyp (queue))) → finite-numberp (qfirst (queue), lub) Event: Disable finite-numberp-qfirst.

Theorem: numberp-qfirst ((¬ qemptyp (queue)) ∧ number-listp (queue)) → (qfirst (queue) ∈ N) Event: Disable numberp-qfirst.

Theorem: deq-is-remove (setp (l) ∧ ('0 < length (l))) → (deq (l) = remove (qfirst (l), l)) Event: Disable deq-is-remove.

Theorem: member-qfirst-queue (¬ qemptyp (queue)) → (qfirst (queue) ∈ queue) Event: Disable member-qfirst-queue.

Theorem: permutation-enq-deq (¬ qemptyp (queue)) → permutation (enq (qfirst (queue), deq (queue)), queue) Event: Disable permutation-enq-deq.

Definition: qhead-field = '0 Definition: qtail-field = '1 Definition: qcurrlength-field = '2 Definition: qmaxlength-field = '3 Definition: qarray-field = '4 Definition: delta (a, b, max) = if if a < b then '*1*false

else '*1*true endif then (max − a) + b else b − a endif

Theorem: delta-a-a (a < max) → (delta (a, a, max) = max)

Event: Disable delta-a-a.

Theorem: delta-incr-mod-a ((a < max) ∧ (b < max)) → (delta (incr-mod (a, max), b, max)

= if delta (a, b, max) = '1 then max else delta (a, b, max) − 1 endif)

Event: Disable delta-incr-mod-a.

Theorem: delta-incr-mod-b ((a < max) ∧ (b < max)) → (delta (a, incr-mod (b, max), max)

= if fix (a) = fix (b) then '1 else 1 + delta (a, b, max) endif)

Event: Disable delta-incr-mod-b.

Theorem: delta-equals-max-iff-a-equals-b ((a ∈ N) ∧ ((b ∈ N) ∧ ((a < max) ∧ (b < max)))) → ((delta (a, b, max) = max) = (a = b))

Event: Disable delta-equals-max-iff-a-equals-b.

Theorem: leq-delta ((a ∈ N) ∧ ((b ∈ N) ∧ ((a < max) ∧ (b < max)))) → if max < delta (a, b, max) then '*1*false

else '*1*true endif

Definition: array-qindex-relation (queue) = (delta (getnth ('0, queue), getnth ('1, queue), getnth ('3, queue))

= if getnth ('2, queue) ≃ 0 then getnth ('3, queue) else getnth ('2, queue) endif)

Definition: array-queuep (queue) = (plistp (queue)

∧ ((length (queue) = ('4 + getnth ('3, queue)))

∧ ((getnth ('0, queue) ∈ N)

∧ ((getnth ('1, queue) ∈ N)

∧ ((getnth ('2, queue) ∈ N)

∧ ((getnth ('3, queue) ≄ 0) ∧ ((getnth ('0, queue) < getnth ('3,

queue))

∧ ((getnth ('1,

queue) < getnth ('3,

queue))

∧ ((getnth ('2,

queue) < (1 + getnth ('3,

queue))) ∧ array-qindex-relation (queue))))))))))

Theorem: plistp-array-queue array-queuep (queue) → plistp (queue)

Event: Disable plistp-array-queue.

Theorem: length-array-queue array-queuep (queue) → (length (queue) = ('4 + getnth ('3, queue)))

Event: Disable length-array-queue.

Theorem: numberp-qhead array-queuep (queue) → (getnth ('0, queue) ∈ N)

Event: Disable numberp-qhead.

Theorem: numberp-qtail array-queuep (queue) → (getnth ('1, queue) ∈ N)

Event: Disable numberp-qtail.

Theorem: numberp-qcurrlength array-queuep (queue) → (getnth ('2, queue) ∈ N)

Event: Disable numberp-qcurrlength.

Theorem: numberp-qmaxlength array-queuep (queue) → (getnth ('3, queue) ∈ N)

Event: Disable numberp-qmaxlength.

Theorem: qmaxlength-non-zero array-queuep (queue) → (getnth ('3, queue) ≠ '0)

Event: Disable qmaxlength-non-zero.

Theorem: qmaxlength-greater-than-zero array-queuep (queue) → ('0 < getnth ('3, queue))

Event: Disable qmaxlength-greater-than-zero.

Theorem: lessp-qhead-qmaxlength array-queuep (queue) → (getnth ('0, queue) < getnth ('3, queue))

Event: Disable lessp-qhead-qmaxlength.

Theorem: lessp-qtail-qmaxlength array-queuep (queue) → (getnth ('1, queue) < getnth ('3, queue))

Event: Disable lessp-qtail-qmaxlength.

Theorem: lessp-qcurrlength-add1-qmaxlength array-queuep (queue) → (getnth ('2, queue) < (1 + getnth ('3, queue)))

Event: Disable lessp-qcurrlength-add1-qmaxlength.

Theorem: plistp-array-qarray plistp (getseg ('4, length (queue) − '4, queue))

Event: Disable plistp-array-qarray.

Theorem: length-array-qarray array-queuep (queue) → (length (getseg ('4, length (queue) − '4, queue)) = getnth ('3, queue))

Event: Disable length-array-qarray.

Definition: array-enq (item, queue) = putnth (incr-mod (getnth ('1, queue), getnth ('3, queue)),

          '1,

putnth (1 + getnth ('2, queue),

                 '2,

putnth (item, '4 + getnth ('1, queue), queue)))

Definition: array-deq (queue) = putnth (incr-mod (getnth ('0, queue), getnth ('3, queue)),

          '0,

putnth (getnth ('2, queue) − 1, '2, queue))

Definition: array-qfirst (queue) = getnth ('4 + getnth ('0, queue), queue)

Definition: array-qfullp (queue) = (getnth ('2, queue) = getnth ('3, queue))

Definition: array-qemptyp (queue) = (getnth ('2, queue) ≃ 0)

Theorem: length-array-enq length (array-enq (item, queue)) = length (queue)

Event: Disable length-array-enq.

Theorem: plistp-array-enq plistp (queue) → plistp (array-enq (item, queue))

Event: Disable plistp-array-enq.

Theorem: array-qhead-array-enq getnth ('0, array-enq (item, queue)) = getnth ('0, queue)

Event: Disable array-qhead-array-enq.

Theorem: array-qtail-array-enq array-queuep (queue) → (getnth ('1, array-enq (item, queue))

= incr-mod (getnth ('1, queue), getnth ('3, queue)))

Event: Disable array-qtail-array-enq.

Theorem: array-qcurrlength-array-enq array-queuep (queue) → (getnth ('2, array-enq (item, queue)) = (1 + getnth ('2, queue)))

Event: Disable array-qcurrlength-array-enq.

Theorem: array-qmaxlength-array-enq getnth ('3, array-enq (item, queue)) = getnth ('3, queue)

Event: Disable array-qmaxlength-array-enq.

Theorem: array-qarray-array-enq array-queuep (queue) → (getseg ('4, getnth ('3, queue), array-enq (item, queue))

= putnth (item, getnth ('1, queue), getseg ('4, getnth ('3, queue), queue)))

Event: Disable array-qarray-array-enq.

Theorem: array-queuep-array-enq (array-queuep (queue) ∧ (¬ array-qfullp (queue))) → array-queuep (array-enq (item, queue))

Event: Disable array-queuep-array-enq.

Theorem: length-array-deq length (array-deq (queue)) = length (queue)

Event: Disable length-array-deq.

Theorem: plistp-array-deq plistp (queue) → plistp (array-deq (queue))

Event: Disable plistp-array-deq.

Theorem: array-qhead-array-deq array-queuep (queue) → (getnth ('0, array-deq (queue))

= incr-mod (getnth ('0, queue), getnth ('3, queue)))

Event: Disable array-qhead-array-deq.

Theorem: array-qtail-array-deq getnth ('1, array-deq (queue)) = getnth ('1, queue)

Event: Disable array-qtail-array-deq.

Theorem: array-qcurrlength-array-deq (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (getnth ('2, array-deq (queue)) = (getnth ('2, queue) − 1))

Event: Disable array-qcurrlength-array-deq.

Theorem: array-qmaxlength-array-deq getnth ('3, array-deq (queue)) = getnth ('3, queue)

Event: Disable array-qmaxlength-array-deq.

Theorem: array-qarray-array-deq getseg ('4, getnth ('3, queue), array-deq (queue)) = getseg ('4, getnth ('3, queue), queue)

Event: Disable array-qarray-array-deq.

Theorem: array-queuep-array-deq (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → array-queuep (array-deq (queue))

Event: Disable array-queuep-array-deq.

Theorem: not-array-qemptyp-array-enq array-queuep (queue) → (¬ array-qemptyp (array-enq (item, queue)))

Event: Disable not-array-qemptyp-array-enq.

Theorem: not-array-qfullp-array-deq array-queuep (queue) → (¬ array-qfullp (array-deq (queue)))

Event: Disable not-array-qfullp-array-deq.

Theorem: array-qcurrlength-in-a-full-queue (array-queuep (queue) ∧ array-qfullp (queue)) → (getnth ('2, queue) = getnth ('3, queue))

Event: Disable array-qcurrlength-in-a-full-queue.

Theorem: array-qcurrlength-in-a-non-full-queue (array-queuep (queue) ∧ (¬ array-qfullp (queue))) → (getnth ('2, queue) < getnth ('3, queue))

Event: Disable array-qcurrlength-in-a-non-full-queue.

Theorem: array-qcurrlength-in-an-empty-queue (array-queuep (queue) ∧ array-qemptyp (queue)) → (getnth ('2, queue) = '0)

Event: Disable array-qcurrlength-in-an-empty-queue.

Theorem: array-qcurrlength-in-a-non-empty-queue (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (getnth ('2, queue) ≠ '0)

Event: Disable array-qcurrlength-in-a-non-empty-queue.

Definition: array-nonlast (queue) = putnth (decr-mod (getnth ('1, queue), getnth ('3, queue)),

          '1,

putnth (getnth ('2, queue) − 1, '2, queue))

Theorem: length-array-nonlast length (array-nonlast (queue)) = length (queue)

Event: Disable length-array-nonlast.

Theorem: plistp-array-nonlast plistp (queue) → plistp (array-nonlast (queue))

Event: Disable plistp-array-nonlast.

Theorem: array-qhead-array-nonlast getnth ('0, array-nonlast (queue)) = getnth ('0, queue)

Event: Disable array-qhead-array-nonlast.

Theorem: array-qtail-array-nonlast array-queuep (queue) → (getnth ('1, array-nonlast (queue))

= decr-mod (getnth ('1, queue), getnth ('3, queue)))

Event: Disable array-qtail-array-nonlast.

Theorem: array-qcurrlength-array-nonlast array-queuep (queue) → (getnth ('2, array-nonlast (queue)) = (getnth ('2, queue) − 1))

Event: Disable array-qcurrlength-array-nonlast.

Theorem: array-qmaxlength-array-nonlast getnth ('3, array-nonlast (queue)) = getnth ('3, queue)

Event: Disable array-qmaxlength-array-nonlast.

Theorem: array-qarray-array-nonlast getseg ('4, getnth ('3, queue), array-nonlast (queue)) = getseg ('4, getnth ('3, queue), queue)

Event: Disable array-qarray-array-nonlast.

Theorem: delta-sub1-b-case1 ((a ∈ N) ∧ ((b ∈ N)

∧ ((b ≠ '0)

∧ ((a < max)
∧ ((b < max)

∧ ((delta (a, b, max) − 1) ≠ '0))))))

→ (delta (a, b − 1, max) = (delta (a, b, max) − 1))

Event: Disable delta-sub1-b-case1.

Theorem: delta-sub1-b-case2 ((a ∈ N) ∧ ((a < max) ∧ ((delta (a, '0, max) − 1) ≠ '0))) → (delta (a, max − 1, max) = (delta (a, '0, max) − 1))

Event: Disable delta-sub1-b-case2.

(PROVE-LEMMA
ARRAY-QUEUEP-ARRAY-NONLAST-CROCK1
(REWRITE)
(IMPLIES
 (AND
  (PLISTP QUEUE)
  (AND
   (EQUAL (LENGTH QUEUE)
          (PLUS '4 (GETNTH '3 QUEUE)))
   (AND
    (NUMBERP (GETNTH '0 QUEUE))
    (AND
     (NUMBERP (GETNTH '1 QUEUE))
     (AND
      (NOT (EQUAL (GETNTH '3 QUEUE) '0))
      (AND (NUMBERP (GETNTH '3 QUEUE))
           (AND (LESSP (GETNTH '0 QUEUE)
                       (GETNTH '3 QUEUE))
                (AND (LESSP (GETNTH '1 QUEUE)
                            (GETNTH '3 QUEUE))
                     (AND (LESSP (SUB1 (GETNTH '2 QUEUE))
                                 (GETNTH '3 QUEUE))
                          (AND (EQUAL (DELTA (GETNTH '0 QUEUE)
                                             (GETNTH '1 QUEUE)
                                             (GETNTH '3 QUEUE))
                                      (GETNTH '2 QUEUE))
                               (AND (NOT (EQUAL (GETNTH '2 QUEUE) '0))
                                    (AND (EQUAL (SUB1 (GETNTH '2 QUEUE)) '0)
                                         (NOT (EQUAL (GETNTH '1 QUEUE)
                                                     '0))))))))))))))
 (EQUAL (GETNTH '0 QUEUE)
        (SUB1 (GETNTH '1 QUEUE))))
((ENABLE DELTA)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable array-queuep-array-nonlast-crock1.

(PROVE-LEMMA
ARRAY-QUEUEP-ARRAY-NONLAST-CROCK2
(REWRITE)

 (IMPLIES
  (AND
   (PLISTP QUEUE)
   (AND
    (EQUAL (LENGTH QUEUE)
           (PLUS '4 (GETNTH '3 QUEUE)))
    (AND
     (NUMBERP (GETNTH '0 QUEUE))
     (AND
      (NUMBERP (GETNTH '1 QUEUE))
      (AND
       (NOT (EQUAL (GETNTH '3 QUEUE) '0))
       (AND (NUMBERP (GETNTH '3 QUEUE))
            (AND (LESSP (GETNTH '0 QUEUE)
                        (GETNTH '3 QUEUE))
                 (AND (LESSP (GETNTH '1 QUEUE)
                             (GETNTH '3 QUEUE))
                      (AND (LESSP (SUB1 (GETNTH '2 QUEUE))
                                  (GETNTH '3 QUEUE))
                           (AND (EQUAL (DELTA (GETNTH '0 QUEUE)
                                              (GETNTH '1 QUEUE)
                                              (GETNTH '3 QUEUE))
                                       (GETNTH '2 QUEUE))
                                (AND (NOT (EQUAL (GETNTH '2 QUEUE) '0))
                                     (AND (EQUAL (SUB1 (GETNTH '2 QUEUE)) '0)
                                          (EQUAL (GETNTH '1 QUEUE)
                                                 '0)))))))))))))
  (EQUAL (GETNTH '0 QUEUE)
         (SUB1 (GETNTH '3 QUEUE))))
 ((ENABLE LENGTH DELTA)
  (ENABLE-THEORY GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable array-queuep-array-nonlast-crock2.

Theorem: array-queuep-array-nonlast (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → array-queuep (array-nonlast (queue))

Event: Disable array-queuep-array-nonlast.

Definition: array-qreplace (item, queue) = array-enq (item, array-nonlast (queue))

Theorem: length-array-qreplace length (array-qreplace (item, queue)) = length (queue)

Event: Disable length-array-qreplace.

Theorem: plistp-array-qreplace plistp (queue) → plistp (array-qreplace (item, queue))

Event: Disable plistp-array-qreplace.

Theorem: array-qhead-array-qreplace getnth ('0, array-qreplace (item, queue)) = getnth ('0, queue)

Event: Disable array-qhead-array-qreplace.

Theorem: array-qtail-array-qreplace (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (getnth ('1, array-qreplace (item, queue)) = getnth ('1, queue))

Event: Disable array-qtail-array-qreplace.

Theorem: array-qcurrlength-array-qreplace (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (getnth ('2, array-qreplace (item, queue)) = getnth ('2, queue))

Event: Disable array-qcurrlength-array-qreplace.

Theorem: array-qmaxlength-array-qreplace getnth ('3, array-qreplace (item, queue)) = getnth ('3, queue)

Event: Disable array-qmaxlength-array-qreplace.

Theorem: array-qarray-array-qreplace (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (getseg ('4, getnth ('3, queue), array-qreplace (item, queue))

= putnth (item, decr-mod (getnth ('1, queue), getnth ('3, queue)), getseg ('4, getnth ('3, queue), queue)))

Event: Disable array-qarray-array-qreplace.

Theorem: not-array-qfullp-array-nonlast array-queuep (queue) → (¬ array-qfullp (array-nonlast (queue)))

Event: Disable not-array-qfullp-array-nonlast.

Theorem: array-queuep-array-qreplace (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → array-queuep (array-qreplace (item, queue))

Event: Disable array-queuep-array-qreplace.

Event: Let us define the theory array-queue-facts to consist of the following events: array-qcurrlength-in-an-empty-queue, array-qcurrlength-in-a-non-empty-queue, array-qcurrlength-in-a-non-full-queue, array-qcurrlength-in-a-full-queue, not-array-qfullp-array-deq, not-array-qemptyp-array-enq, array-queuep-array-qreplace, array-qmaxlength-array-qreplace, array-qcurrlength-array-qreplace, array-qtail-array-qreplace, array-qhead-array-qreplace, plistp-array-qreplace, lengtharray-qreplace, array-queuep-array-deq, array-qmaxlength-array-deq, array-qcurrlength-array-deq, array-qtail-array-deq, array-qhead-array-deq, plistp-array-deq, lengtharray-deq, array-queuep-array-enq, array-qmaxlength-array-enq, array-qcurrlength-array-enq, array-qtail-array-enq, array-qhead-array-enq, plistp-array-enq, lengtharray-enq, length-array-qarray, plistp-array-qarray, lessp-qcurrlength-add1-qmaxlength, lessp-qtail-qmaxlength, lessp-qhead-qmaxlength, qmaxlength-greater-than-zero, qmaxlength-non-zero, numberp-qmaxlength, numberp-qcurrlength, numberpqtail, numberp-qhead.

Theorem: array-qfullp-implies-not-array-qemptyp (array-queuep (queue) ∧ array-qfullp (queue)) → (¬ array-qemptyp (queue))

Theorem: array-qhead-equals-array-qtail-in-an-empty-queue (array-queuep (queue) ∧ array-qemptyp (queue)) → (getnth ('0, queue) = getnth ('1, queue))

Event: Disable array-qhead-equals-array-qtail-in-an-empty-queue.

Theorem: array-qhead-equals-array-qtail-iff-qfull-or-qempty array-queuep (queue) → ((getnth ('0, queue) = getnth ('1, queue))

= (array-qfullp (queue) ∨ array-qemptyp (queue)))

Event: Disable array-qhead-equals-array-qtail-iff-qfull-or-qempty.

Definition: delta-segment (a, b, s)

= if if a < b then '*1*false

else '*1*true endif then append (getseg (a, length (s) − a, s), getseg ('0, b, s)) else getseg (a, b − a, s) endif

Theorem: delta-equals-length-delta-segment ((a < length (s)) ∧ (b < length (s))) → (length (delta-segment (a, b, s)) = delta (a, b, length (s)))

Event: Disable delta-equals-length-delta-segment.

Theorem: plistp-delta-segment plistp (delta-segment (a, b, s))

Event: Disable plistp-delta-segment.

Theorem: finite-number-listp-delta-segment (finite-number-listp (s, lub) ∧ ((b ∈ N)

∧ (if length (s) < b then '*1*false else '*1*true endif ∧ ((a ∈ N)

∧ if length (s) < a then '*1*false

else '*1*true endif))))

→ finite-number-listp (delta-segment (a, b, s), lub)

Event: Disable finite-number-listp-delta-segment.

Theorem: length-delta-segment ((a ∈ N) ∧ ((b ∈ N) ∧ ((a < length (s)) ∧ (b < length (s))))) → if length (s) < length (delta-segment (a, b, s)) then '*1*false

else '*1*true endif

Definition: mapup-queue (queue) = if array-qemptyp (queue) then 'nil

else delta-segment (getnth ('0, queue), getnth ('1, queue), getseg ('4, getnth ('3, queue), queue)) endif

Theorem: finite-number-listp-mapup-queue (array-queuep (queue) ∧ finite-number-listp (getseg ('4, getnth ('3, queue), queue), lub)) → finite-number-listp (mapup-queue (queue), lub)

Event: Disable finite-number-listp-mapup-queue.

Theorem: plistp-mapup-queue plistp (mapup-queue (queue))

Event: Disable plistp-mapup-queue.

Theorem: length-mapup-queue array-queuep (queue) → if getnth ('3, queue) < length (mapup-queue (queue)) then '*1*false

else '*1*true endif

Theorem: delta-segment-incr-mod-b (plistp (s) ∧ ((a ∈ N)

∧ ((b ∈ N)

∧ ((a < n) ∧ ((b < n) ∧ (n = length (s)))))))

→ (delta-segment (a, incr-mod (b, n), s)

= if a = b then cons (getnth (a, s), 'nil) else append (delta-segment (a, b, s),

cons (getnth (b, s), 'nil)) endif)

Event: Disable delta-segment-incr-mod-b.

Theorem: delta-segment-putnth-non-interference ((a ∈ N) ∧ ((b ∈ N)

∧ ((a < length (s)) ∧ ((b < length (s)) ∧ (a ≠ b))))) → (delta-segment (a, b, putnth (v, b, s)) = delta-segment (a, b, s))

Event: Disable delta-segment-putnth-non-interference.

Theorem: correctness-of-array-enq (array-queuep (queue) ∧ (¬ array-qfullp (queue))) → (mapup-queue (array-enq (item, queue)) = enq (item, mapup-queue (queue)))

Event: Disable correctness-of-array-enq.

Theorem: delta-segment-incr-mod-a (plistp (s) ∧ ((a ∈ N)

∧ ((b ∈ N)

∧ ((a < n) ∧ ((b < n) ∧ (n = length (s)))))))

→ (delta-segment (incr-mod (a, n), b, s)

= if delta (a, b, n) = '1 then delta-segment (b, b, s) else cdr (delta-segment (a, b, s)) endif)

Event: Disable delta-segment-incr-mod-a.

Theorem: array-qemtpyp-array-deq-when-delta-is-1 (array-queuep (queue) ∧ ((¬ array-qemptyp (queue))

∧ (delta (getnth ('0, queue), getnth ('1, queue), getnth ('3, queue))

= '1)))

→ array-qemptyp (array-deq (queue))

Event: Disable array-qemtpyp-array-deq-when-delta-is-1.

Theorem: array-qemtpyp-array-deq-when-delta-is-1-alternative (array-queuep (queue) ∧ ((¬ array-qemptyp (queue)) ∧ array-qemptyp (array-deq (queue)))) → (delta (getnth ('0, queue), getnth ('1, queue), getnth ('3, queue)) = '1)

Event: Disable array-qemtpyp-array-deq-when-delta-is-1-alternative.

Theorem: correctness-of-array-deq-case-3 (array-queuep (queue) ∧ ((¬ array-qemptyp (queue)) ∧ array-qemptyp (array-deq (queue)))) → (cdr (delta-segment (getnth ('0, queue),

getnth ('1, queue),

getseg ('4, getnth ('3, queue), queue)))

     = 'nil)

Event: Disable correctness-of-array-deq-case-3.

Theorem: array-qmaxlength-must-be-1 (array-queuep (queue) ∧ (array-qfullp (queue) ∧ array-qemptyp (array-deq (queue)))) → (getnth ('3, queue) = '1)

Event: Disable array-qmaxlength-must-be-1.

Theorem: length-delta-segment-a-a (array-queuep (queue)

∧ (array-qfullp (queue) ∧ array-qemptyp (array-deq (queue)))) → (length (delta-segment (getnth ('0, queue),

getnth ('0, queue),

getseg ('4, getnth ('3, queue), queue)))

     = '1)

Event: Disable length-delta-segment-a-a.

Theorem: correctness-of-array-deq-case-1 (array-queuep (queue) ∧ (array-qfullp (queue) ∧ array-qemptyp (array-deq (queue)))) → (cdr (delta-segment (getnth ('0, queue),

getnth ('0, queue),

getseg ('4, getnth ('3, queue), queue)))

     = 'nil)

Event: Disable correctness-of-array-deq-case-1.

Theorem: correctness-of-array-deq (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (mapup-queue (array-deq (queue)) = deq (mapup-queue (queue)))

Event: Disable correctness-of-array-deq.

Theorem: correctness-of-array-qfirst (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (array-qfirst (queue) = qfirst (mapup-queue (queue)))

Event: Disable correctness-of-array-qfirst.

Theorem: correctness-of-array-qemptyp array-queuep (queue) → (array-qemptyp (queue) = qemptyp (mapup-queue (queue)))

Event: Disable correctness-of-array-qemptyp.

Theorem: correctness-of-array-qfullp (array-queuep (queue) ∧ (max = getnth ('3, queue))) → (array-qfullp (queue) = qfullp (mapup-queue (queue), max))

Theorem: length-delta-segment-decr-mod-arg1 ((a ∈ N) ∧ ((b = length (s)) ∧ (a < length (s)))) → (length (delta-segment (decr-mod (a, b), a, s)) = '1)

Event: Disable length-delta-segment-decr-mod-arg1.

Theorem: nonlast-of-length-1 (length (l) = '1) → (nonlast (l) = 'nil)

Event: Disable nonlast-of-length-1.

Theorem: correctness-of-array-nonlast-case1 (array-queuep (queue) ∧ ((¬ array-qemptyp (queue)) ∧ array-qemptyp (array-nonlast (queue)))) → (nonlast (delta-segment (getnth ('0, queue),

getnth ('1, queue),

getseg ('4, getnth ('3, queue), queue)))

     = 'nil)

Event: Disable correctness-of-array-nonlast-case1.

Theorem: delta-segment-decr-mod-arg2 ((a ∈ N) ∧ ((a < length (s))

∧ ((b ∈ N)

∧ ((b < length (s)) ∧ (a ≠ decr-mod (b, length (s)))))))

→ (delta-segment (a, decr-mod (b, length (s)), s)

= nonlast (delta-segment (a, b, s)))

Event: Disable delta-segment-decr-mod-arg2.

Theorem: correctness-of-array-nonlast-case2 (array-queuep (queue) ∧ ((¬ array-qemptyp (queue))

∧ (¬ array-qemptyp (array-nonlast (queue))))) → (delta-segment (getnth ('0, queue),

decr-mod (getnth ('1, queue), getnth ('3, queue)), getseg ('4, getnth ('3, queue), queue))

= nonlast (delta-segment (getnth ('0, queue), getnth ('1, queue), getseg ('4, getnth ('3, queue), queue))))

Event: Disable correctness-of-array-nonlast-case2.

Theorem: correctness-of-array-nonlast (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (mapup-queue (array-nonlast (queue)) = nonlast (mapup-queue (queue)))

Event: Disable correctness-of-array-nonlast.

Theorem: correctness-of-array-qreplace (array-queuep (queue) ∧ (¬ array-qemptyp (queue))) → (mapup-queue (array-qreplace (item, queue))

= qreplace (item, mapup-queue (queue)))

Event: Disable correctness-of-array-qreplace.

Theorem: length-mapup-queue-is-qcurrlength array-queuep (queue) → (length (mapup-queue (queue)) = getnth ('2, queue))

Event: Disable length-mapup-queue-is-qcurrlength.

Definition: qfirst2 (i, j , qtable) = qfirst (getnth2 (i, j , qtable))

Definition: enq2 (msg, i, j , qtable) = putnth2 (enq (msg, getnth2 (i, j , qtable)), i, j , qtable)

Definition: deq2 (i, j , qtable) = putnth2 (deq (getnth2 (i, j , qtable)), i, j , qtable)

Definition: qfullp2 (i, j , qtable, max) = qfullp (getnth2 (i, j , qtable), max)

Definition: qemptyp2 (i, j , qtable) = qemptyp (getnth2 (i, j , qtable))

Theorem: array-qemptyp-implies-not-array-qfullp (array-queuep (queue) ∧ array-qemptyp (queue)) → (¬ array-qfullp (queue))

Theorem: array-qfirst-array-enq (array-queuep (queue) ∧ ((¬ array-qemptyp (queue)) ∧ (¬ array-qfullp (queue)))) → (array-qfirst (array-enq (item, queue)) = array-qfirst (queue))

Event: Disable array-qfirst-array-enq.

Theorem: array-qfirst-array-enq1 (array-queuep (queue) ∧ array-qemptyp (queue)) → (array-qfirst (array-enq (item, queue)) = item)

Event: Disable array-qfirst-array-enq1.

Definition: tm-wordsize = '16

Definition: tm-wordlub = '65536

Definition: alu-result (value, carry) = cons (value, cons (carry, 'nil))

Definition: alu-value (alu-result) = car (alu-result)

Definition: alu-carry (alu-result) = car (cdr (alu-result))

Definition: tm-alu-decr (a)

= if a ≃ 0 then '(65535 *1*true)

else alu-result ((a − 1) mod '65536, '*1*false) endif

Definition: tm-alu-decr-mod (a, b) = alu-result (decr-mod (a mod '65536, b mod '65536), '*1*false)

Definition: tm-alu-difference (a, b) = if b < a

then alu-result (('65536 − (a − b)) mod '65536, '*1*true)

else alu-result ((b − a) mod '65536, '*1*false) endif

Definition: tm-alu-incr (a) = if (1 + a) < '65536 then alu-result (1 + a, '*1*false)

    else '(0 *1*true) endif

Definition: tm-alu-incr-mod (a, b) = alu-result (incr-mod (a mod '65536, b mod '65536), '*1*false)

Definition: tm-alu-mod (a, b) = if (b mod '65536) ≃ 0 then alu-result (a mod '65536, '*1*false)

else alu-result (a mod (b mod '65536), '*1*false) endif

Definition: tm-alu-mult (a, b) = if (a ∗ b) < '65536 then alu-result (a ∗ b, '*1*false)

else alu-result ((a ∗ b) mod '65536, '*1*true) endif Definition: tm-alu-plus (a, b) = if (a + b) < '65536 then alu-result (a + b, '*1*false)

else alu-result ((a + b) mod '65536, '*1*true) endif

Theorem: finite-numberp-alu-value-tm-alu-decr finite-numberp (alu-value (tm-alu-decr (a)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-decr.

Theorem: lessp-alu-value-tm-alu-decr-wordsize (alu-value (tm-alu-decr (a)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-decr-wordsize.

Theorem: lessp-alu-value-tm-alu-decr-wordsize-linear alu-value (tm-alu-decr (a)) < '65536

Event: Disable lessp-alu-value-tm-alu-decr-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-decr alu-value (tm-alu-decr (a)) ∈ N

Event: Disable numberp-alu-value-tm-alu-decr.

Theorem: tm-alu-decr-value-identical-to-ideal-result ((a ≄ 0) ∧ (a < '65536)) → (alu-value (tm-alu-decr (a)) = (a − 1))

Event: Disable tm-alu-decr-value-identical-to-ideal-result.

Theorem: finite-numberp-alu-value-tm-alu-decr-mod finite-numberp (alu-value (tm-alu-decr-mod (a, b)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-decr-mod.

Theorem: lessp-alu-value-tm-alu-decr-mod-wordsize (alu-value (tm-alu-decr-mod (a, b)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-decr-mod-wordsize.

Theorem: lessp-alu-value-tm-alu-decr-mod-wordsize-linear alu-value (tm-alu-decr-mod (a, b)) < '65536 Event: Disable lessp-alu-value-tm-alu-decr-mod-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-decr-mod alu-value (tm-alu-decr-mod (a, b)) ∈ N

Event: Disable numberp-alu-value-tm-alu-decr-mod.

Theorem: tm-alu-decr-mod-value-identical-to-ideal-result

 ((a < '65536) ∧ (b < '65536))

→ (alu-value (tm-alu-decr-mod (a, b)) = decr-mod (a, b))

Event: Disable tm-alu-decr-mod-value-identical-to-ideal-result.

Theorem: finite-numberp-alu-value-tm-alu-incr finite-numberp (alu-value (tm-alu-incr (a)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-incr.

Theorem: lessp-alu-value-tm-alu-incr-wordsize (alu-value (tm-alu-incr (a)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-incr-wordsize.

Theorem: lessp-alu-value-tm-alu-incr-wordsize-linear alu-value (tm-alu-incr (a)) < '65536

Event: Disable lessp-alu-value-tm-alu-incr-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-incr alu-value (tm-alu-incr (a)) ∈ N

Event: Disable numberp-alu-value-tm-alu-incr.

Theorem: tm-alu-incr-value-identical-to-ideal-result ((1 + a) < '65536) → (alu-value (tm-alu-incr (a)) = (1 + a))

Event: Disable tm-alu-incr-value-identical-to-ideal-result.

Theorem: finite-numberp-alu-value-tm-alu-incr-mod finite-numberp (alu-value (tm-alu-incr-mod (a, b)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-incr-mod.

Theorem: lessp-alu-value-tm-alu-incr-mod-wordsize (alu-value (tm-alu-incr-mod (a, b)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-incr-mod-wordsize.

Theorem: lessp-alu-value-tm-alu-incr-mod-wordsize-linear alu-value (tm-alu-incr-mod (a, b)) < '65536

Event: Disable lessp-alu-value-tm-alu-incr-mod-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-incr-mod alu-value (tm-alu-incr-mod (a, b)) ∈ N

Event: Disable numberp-alu-value-tm-alu-incr-mod.

Theorem: tm-alu-incr-mod-value-identical-to-ideal-result

 ((a < '65536) ∧ (b < '65536))

→ (alu-value (tm-alu-incr-mod (a, b)) = incr-mod (a, b))

Event: Disable tm-alu-incr-mod-value-identical-to-ideal-result.

Theorem: finite-numberp-alu-value-tm-alu-mod finite-numberp (alu-value (tm-alu-mod (a, b)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-mod.

Theorem: lessp-alu-value-tm-alu-mod-wordsize (alu-value (tm-alu-mod (a, b)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-mod-wordsize.

Theorem: lessp-alu-value-tm-alu-mod-wordsize-linear alu-value (tm-alu-mod (a, b)) < '65536

Event: Disable lessp-alu-value-tm-alu-mod-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-mod alu-value (tm-alu-mod (a, b)) ∈ N

Event: Disable numberp-alu-value-tm-alu-mod.

Theorem: tm-alu-mod-value-identical-to-ideal-result ((b ≄ 0) ∧ (b < '65536)) → (alu-value (tm-alu-mod (a, b)) = (a mod b))

Event: Disable tm-alu-mod-value-identical-to-ideal-result.

Theorem: finite-numberp-alu-value-tm-alu-mult finite-numberp (alu-value (tm-alu-mult (a, b)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-mult.

Theorem: lessp-alu-value-tm-alu-mult-wordsize (alu-value (tm-alu-mult (a, b)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-mult-wordsize.

Theorem: lessp-alu-value-tm-alu-mult-wordsize-linear alu-value (tm-alu-mult (a, b)) < '65536

Event: Disable lessp-alu-value-tm-alu-mult-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-mult alu-value (tm-alu-mult (a, b)) ∈ N

Event: Disable numberp-alu-value-tm-alu-mult.

Theorem: tm-alu-mult-value-identical-to-ideal-result ((a ∗ b) < '65536) → (alu-value (tm-alu-mult (a, b)) = (a ∗ b))

Event: Disable tm-alu-mult-value-identical-to-ideal-result.

Theorem: finite-numberp-alu-value-tm-alu-plus finite-numberp (alu-value (tm-alu-plus (a, b)), '65536)

Event: Disable finite-numberp-alu-value-tm-alu-plus.

Theorem: lessp-alu-value-tm-alu-plus-wordsize (alu-value (tm-alu-plus (a, b)) < '65536) = '*1*true

Event: Disable lessp-alu-value-tm-alu-plus-wordsize.

Theorem: lessp-alu-value-tm-alu-plus-wordsize-linear alu-value (tm-alu-plus (a, b)) < '65536 Event: Disable lessp-alu-value-tm-alu-plus-wordsize-linear.

Theorem: numberp-alu-value-tm-alu-plus alu-value (tm-alu-plus (a, b)) ∈ N

Event: Disable numberp-alu-value-tm-alu-plus.

Theorem: tm-alu-plus-value-identical-to-ideal-result ((a + b) < '65536) → (alu-value (tm-alu-plus (a, b)) = (a + b))

Event: Disable tm-alu-plus-value-identical-to-ideal-result.

Event: Let us define the theory tm-alu-arithmetic to consist of the following events: tm-alu-plus-value-identical-to-ideal-result, numberp-alu-value-tm-alu-plus, lessp-alu-value-tm-alu-plus-wordsize-linear, lessp-alu-value-tm-alu-plus-wordsize, finite-numberp-alu-value-tm-alu-plus, tm-alu-mult-value-identical-to-ideal-result, numberp-alu-value-tm-alu-mult, lessp-alu-value-tm-alu-mult-wordsize-linear, lessp-alu-value-tm-alu-mult-wordsize, finite-numberp-alu-value-tm-alu-mult, tm-alu-mod-value-identical-to-ideal-result, numberp-alu-value-tm-alu-mod, lesspalu-value-tm-alu-mod-wordsize-linear, lessp-alu-value-tm-alu-mod-wordsize, finitenumberp-alu-value-tm-alu-mod, tm-alu-incr-mod-value-identical-to-ideal-result, numberp-alu-value-tm-alu-incr-mod, lessp-alu-value-tm-alu-incr-mod-wordsize-linear, lessp-alu-value-tm-alu-incr-mod-wordsize, finite-numberp-alu-value-tm-alu-incr-mod, tm-alu-incr-value-identical-to-ideal-result, numberp-alu-value-tm-alu-incr, lessp-alu-value-tm-alu-incr-wordsize-linear, lessp-alu-value-tm-alu-incr-wordsize, finite-numberp-alu-value-tm-alu-incr, tm-alu-decr-mod-value-identical-to-ideal-result, numberp-alu-value-tm-alu-decr-mod, lessp-alu-value-tm-alu-decr-mod-wordsize-linear, lessp-alu-value-tm-alu-decr-mod-wordsize, finite-numberp-alu-value-tm-alu-decr-mod, tm-alu-decr-value-identical-to-ideal-result, numberpalu-value-tm-alu-decr, lessp-alu-value-tm-alu-decr-wordsize-linear, lessp-alu-value-tm-alu-decr-wordsize, finite-numberp-alu-value-tm-alu-decr.

Definition: tm-incr (a) = ((1 + a) mod '65536)

Definition: tm-incrn (n, a) = if n ≃ 0 then a

else tm-incr (tm-incrn (n − 1, a)) endif

Definition: tm-decr (a) = if a ≃ 0 then '65535

else a − 1 endif Theorem: finite-numberp-tm-incr finite-numberp (tm-incr (a), '65536)

Event: Disable finite-numberp-tm-incr.

Theorem: finite-numberp-tm-incrn finite-numberp (a, '65536) → finite-numberp (tm-incrn (n, a), '65536)

Event: Disable finite-numberp-tm-incrn.

Theorem: finite-numberp-tm-decr finite-numberp (a, '65536) → finite-numberp (tm-decr (a), '65536)

Event: Disable finite-numberp-tm-decr.

Event: Add the shell tm, with recognizer function symbol tm-shellp and 14 accessors: tm-memory, with type restriction (none-of) and default value zero; tm-regs, with type restriction (none-of) and default value zero; tm-cc, with type restriction (none-of) and default value zero; tm-error, with type restriction (none-of) and default value zero; tm-svcflag, with type restriction (none-of) and default value zero; tm-svcid, with type restriction (none-of) and default value zero; tm-base, with type restriction (none-of) and default value zero; tm-limit, with type restriction (none-of) and default value zero; tm-slimit, with type restriction (none-of) and default value zero; tm-svmode, with type restriction (none-of) and default value zero; tm-rwstate, with type restriction (none-of) and default value zero; tm-clock, with type restriction (none-of) and default value zero; tm-iports, with type restriction (none-of) and default value zero; tm-oports, with type restriction (none-of) and default value zero.

Definition: tm-regsize = '3

Definition: tm-charsize = '8

Definition: tm-ccsize = '2

Definition: tm-errorsize = '6

Definition: tm-svcflagsize = '1

Definition: tm-svcidsize = '7

Definition: tm-cclub = '4

Definition: tm-errorlub = '64 Definition: tm-svcflaglub = '2

Definition: tm-svcidlub = '128

Definition: tm-reglength = '8

Definition: tm-memlength = '65536

Definition: tm-charlub = '256

Definition: tm-port-length = '16

Definition: tm-pc-address = '0

Definition: tm-sp-address = '1

Definition: tm-set-memory (memory, tm) = tm (memory,

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-regs (regs, tm) = tm (tm-memory (tm),

regs, tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-cc (cc, tm) = tm (tm-memory (tm),

tm-regs (tm), cc, tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-error (error, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), error, tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-svcflag (svcflag, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), svcflag, tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-svcid (svcid, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), svcid, tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-base (base, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), base, tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-limit (limit, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), limit, tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-slimit (slimit, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), slimit, tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-svmode (svmode, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), svmode, tm-rwstate (tm), tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-rwstate (rwstate, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), rwstate, tm-clock (tm), tm-iports (tm), tm-oports (tm))

Definition: tm-set-clock (clock, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), clock, tm-iports (tm), tm-oports (tm))

Definition: tm-set-iports (iports, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), iports, tm-oports (tm))

Definition: tm-set-oports (oports, tm) = tm (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm), tm-slimit (tm), tm-svmode (tm), tm-rwstate (tm), tm-clock (tm), tm-iports (tm), oports)

Definition: tm-pc (tm) = getnth ('0, tm-regs (tm))

Definition: tm-set-pc (pc, tm) = tm-set-regs (putnth (pc, '0, tm-regs (tm)), tm)

Definition: tm-sp (tm) = getnth ('1, tm-regs (tm))

Definition: tm-set-sp (sp, tm) = tm-set-regs (putnth (sp, '1, tm-regs (tm)), tm)

Definition: tm-non-zero-no-carry-condition = '0

Definition: tm-zero-no-carry-condition = '1

Definition: tm-non-zero-carry-condition = '2

Definition: tm-zero-carry-condition = '3 Definition: tm-cc-value (alu-result) = if alu-value (alu-result) ≃ 0

then if falsep (alu-carry (alu-result)) then '1

else '3 endif elseif falsep (alu-carry (alu-result)) then '0 else '2 endif

Definition: tm-cc-divisor = '4

Definition: tm-error-divisor = '256

Definition: tm-svcflag-divisor = '512

Definition: tm-pack-psw (cc, error, svcflag, svcid) = (cc + ((error ∗ '4)

+ ((svcflag ∗ '256) + (svcid ∗ '512))))

Theorem: finite-numberp-tm-pack-psw1 (finite-numberp (cc, '4) ∧ (finite-numberp (error, '64)

∧ (finite-numberp (svcflag, '2) ∧ finite-numberp (svcid, '128)))) → finite-numberp (tm-pack-psw (cc, error, svcflag, svcid), '65536)

Event: Disable finite-numberp-tm-pack-psw1.

Definition: tm-unpack-cc (psw) = (psw mod '4)

Definition: tm-unpack-error (psw) = ((psw mod '256) ÷ '4)

Definition: tm-unpack-svcflag (psw) = ((psw mod '512) ÷ '256)

Definition: tm-unpack-svcid (psw) = (psw ÷ '512)

Theorem: finite-numberp-tm-unpack-cc finite-numberp (tm-unpack-cc (psw), '4)

Event: Disable finite-numberp-tm-unpack-cc.

Theorem: finite-numberp-tm-unpack-error finite-numberp (tm-unpack-error (psw), '64)

Event: Disable finite-numberp-tm-unpack-error.

Theorem: finite-numberp-tm-unpack-svcflag finite-numberp (tm-unpack-svcflag (psw), '2) Event: Disable finite-numberp-tm-unpack-svcflag.

Theorem: finite-numberp-tm-unpack-svcid finite-numberp (psw, '65536) → finite-numberp (tm-unpack-svcid (psw), '128) Event: Disable finite-numberp-tm-unpack-svcid.

Definition: tm-register-save-area-addr = '0 Definition: tm-clock-new-pc-addr = '3 Definition: tm-error-new-pc-addr = '4 Definition: tm-svc-new-pc-addr = '5 Definition: tm-input-new-pc-addr = '6 Definition: tm-output-new-pc-addr = '7 Definition: tm-svcid-addr = '8 Definition: tm-input-devid-addr = '8 Definition: tm-input-char-addr = '9 Definition: tm-output-devid-addr = '9 Definition: tm-no-error = '0 Definition: tm-halt-status = '1 Definition: tm-opcode-error = '2 Definition: tm-privilege-error = '3 Definition: tm-stack-overflow-error = '4 Definition: tm-stack-underflow-error = '5 Definition: tm-address-error = '6 Definition: tm-pc-address-error = '7 Definition: tm-supervisor-mode = '1 Definition: tm-user-mode = '0

Definition: tm-in-supervisor-mode (tm) = (tm-svmode (tm) = '1)

Definition: tm-wait-state = '1

Definition: tm-run-state = '0

Definition: tm-waiting (tm) = (tm-rwstate (tm) = '1)

Definition: tm-svc = '1

Definition: tm-no-svc = '0

Definition: tm-cleared-svcflag = '0

Event: Add the shell tm-iport, with recognizer function symbol tm-iportp and 3 accessors: tm-iinterrupt-flag, with type restriction (none-of) and default value zero; tm-ierror-flag, with type restriction (none-of) and default value zero; tmichar, with type restriction (none-of) and default value zero.

Event: Add the shell tm-oport, with recognizer function symbol tm-oportp and 3 accessors: tm-ointerrupt-flag, with type restriction (none-of) and default value zero; tm-obusy-flag, with type restriction (none-of) and default value zero; tm-ochar, with type restriction (none-of) and default value zero.

Definition: tm-iport-errorp (id, ports) = (tm-ierror-flag (getnth (id, ports)) = '1)

Definition: tm-clear-input-interrupt (id, ports) = putnth (tm-iport ('0,

tm-ierror-flag (getnth (id, ports)), tm-ichar (getnth (id, ports))),

id, ports)

Definition: tm-post-input-interrupt (char, id, ports) = putnth (tm-iport ('1, tm-iinterrupt-flag (getnth (id, ports)), char),

id, ports)

Definition: tm-oport-idlep (id, ports) = (tm-obusy-flag (getnth (id, ports)) = '0)

Definition: tm-start-output (char, id, ports) = putnth (tm-oport ('0, '1, char mod '256), id, ports)

Definition: tm-post-output-interrupt (id, ports)

= putnth ('(*1*quote tm-oport 1 0 0), id, ports)

Definition: tm-clear-output-interrupt (id, ports) = putnth (tm-oport ('0,

tm-obusy-flag (getnth (id, ports)), tm-ochar (getnth (id, ports))),

id, ports)

Definition: real-addr (source, num) = cons (source, cons (num, 'nil))

Definition: real-addr-source (real-addr) = car (real-addr)

Definition: real-addr-num (real-addr) = car (cdr (real-addr))

Definition: tm-arg-mode (x) = car (x)

Definition: tm-arg-datum (x) = car (cdr (x))

Definition: tm-arg-index (x) = car (cdr (cdr (x)))

Definition: tm-fix-word (n) = (n mod '65536)

Definition: tm-fix-reg-address (n) = (n mod '8)

Definition: tm-compute-address (arg, tm) = if tm-arg-mode (arg) ≃ 0

then real-addr ('0,

tm-fix-word (tm-arg-datum (arg) + tm-arg-index (arg)))

elseif tm-arg-mode (arg) = '1

then real-addr ('1, tm-fix-reg-address (tm-arg-datum (arg))) elseif tm-arg-mode (arg) = '2 then real-addr ('2,

tm-fix-word (tm-arg-datum (arg) + tm-arg-index (arg)))

else real-addr ('2,

tm-fix-word (getnth (tm-fix-reg-address (tm-arg-datum (arg)),

tm-regs (tm)) + tm-arg-index (arg))) endif Definition: tm-good-address (addr, tm) = if real-addr-source (addr) ≃ 0

then finite-numberp (real-addr-num (addr), '65536)

elseif real-addr-source (addr) = '1

then finite-numberp (real-addr-num (addr), '8)

elseif tm-in-supervisor-mode (tm)

then finite-numberp (real-addr-num (addr), '65536)

else finite-numberp (real-addr-num (addr), min ('65536 − tm-base (tm), tm-limit (tm))) endif

Definition: tm-incr-address (addr) = if real-addr-source (addr) ≃ 0

then real-addr (real-addr-source (addr), tm-incr (real-addr-num (addr))) elseif real-addr-source (addr) = '1 then real-addr (real-addr-source (addr),

(1 + real-addr-num (addr)) mod '8)

else real-addr (real-addr-source (addr), tm-incr (real-addr-num (addr))) endif

Definition: tm-incrn-address (n, a) = if n ≃ 0 then a

else tm-incr-address (tm-incrn-address (n − 1, a)) endif

Definition: tm-fetch-from-memory (addr, tm) = if tm-in-supervisor-mode (tm) then getnth (addr, tm-memory (tm))

else getnth (tm-base (tm) + addr, tm-memory (tm)) endif

Definition: tm-store-in-memory (value, addr, tm) = if tm-in-supervisor-mode (tm)

then tm-set-memory (putnth (value, addr, tm-memory (tm)), tm)

else tm-set-memory (putnth (value, tm-base (tm) + addr, tm-memory (tm)),

tm) endif

Definition: tm-fetch-from-regmem (addr, tm) = getnth (addr, tm-regs (tm))

Definition: tm-store-in-regmem (value, addr, tm) = tm-set-regs (putnth (value, addr, tm-regs (tm)), tm)

Definition: tm-fetch (addr, tm) = if real-addr-source (addr) ≃ 0 then real-addr-num (addr)

elseif real-addr-source (addr) = '1

then tm-fetch-from-regmem (real-addr-num (addr), tm)

else tm-fetch-from-memory (real-addr-num (addr), tm) endif

Definition: tm-store (value, addr, tm) = if real-addr-source (addr) ≃ 0 then tm

elseif real-addr-source (addr) = '1

then tm-store-in-regmem (value, real-addr-num (addr), tm)

else tm-store-in-memory (value, real-addr-num (addr), tm) endif

Definition: tm-stack-overflowp (tm) = (tm-sp (tm) ≃ 0)

Definition: tm-stack-underflowp (tm) = if tm-in-supervisor-mode (tm) then (1 + tm-sp (tm)) ≮ tm-slimit (tm)

else (1 + tm-sp (tm))

≮ min ('65536 − tm-base (tm), tm-limit (tm)) endif

Theorem: tm-stack-underflowp-guards-good-address ((¬ tm-stack-underflowp (tm)) ∧ finite-numberp (tm-slimit (tm), '65536)) → tm-good-address (real-addr ('2, 1 + tm-sp (tm)), tm)

Event: Disable tm-stack-underflowp-guards-good-address.

Definition: tm-execute-add (addr1 , addr2 , tm) = tm-store (alu-value (tm-alu-plus (tm-fetch (addr1 , tm), tm-fetch (addr2 , tm))),

addr1 ,

tm-set-cc (tm-cc-value (tm-alu-plus (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

tm))

Definition: tm-execute-branch (addr, tm) = tm-set-pc (tm-fetch (addr, tm), tm)

Definition: tm-execute-branch-on-zero (addr, tm) = if tm-cc (tm) = '1 then tm-set-pc (tm-fetch (addr, tm), tm)

else tm endif Definition: tm-execute-branch-not-zero (addr, tm) = if tm-cc (tm) = '1 then tm

else tm-set-pc (tm-fetch (addr, tm), tm) endif

Definition: tm-execute-call (addr, tm) = if tm-stack-overflowp (tm) then tm-set-error ('4, tm)

elseif tm-good-address (real-addr ('2, tm-sp (tm)), tm)

then tm-store (tm-pc (tm), real-addr ('2, tm-sp (tm)), tm-set-pc (tm-fetch (addr, tm),

tm-set-sp (tm-decr (tm-sp (tm)), tm)))

else tm-set-error ('6, tm) endif

Definition: tm-execute-compare (addr1 , addr2 , tm) = tm-set-cc (tm-cc-value (tm-alu-difference (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

tm)

Definition: tm-execute-decr (addr, tm) = tm-store (alu-value (tm-alu-decr (tm-fetch (addr, tm))),

addr,

tm-set-cc (tm-cc-value (tm-alu-decr (tm-fetch (addr, tm))), tm))

Definition: tm-execute-decr-mod (addr1 , addr2 , tm) = tm-store (alu-value (tm-alu-decr-mod (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

addr1 ,

tm-set-cc (tm-cc-value (tm-alu-decr-mod (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

tm))

Definition: tm-execute-incr (addr, tm) = tm-store (alu-value (tm-alu-incr (tm-fetch (addr, tm))),

addr,

tm-set-cc (tm-cc-value (tm-alu-incr (tm-fetch (addr, tm))), tm))

Definition: tm-execute-incr-mod (addr1 , addr2 , tm) = tm-store (alu-value (tm-alu-incr-mod (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

addr1 ,

tm-set-cc (tm-cc-value (tm-alu-incr-mod (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

tm))

Definition: tm-execute-load-base (addr, tm) = if tm-in-supervisor-mode (tm) then tm-set-base (tm-fetch (addr, tm), tm)

else tm-set-error ('3, tm) endif

Definition: tm-execute-load-limit (addr, tm) = if tm-in-supervisor-mode (tm) then tm-set-limit (tm-fetch (addr, tm), tm)

else tm-set-error ('3, tm) endif

Definition: tm-execute-load-psw (addr, tm) = if tm-in-supervisor-mode (tm)

then tm-set-svmode ('0,

tm-set-pc (tm-fetch (addr, tm),

tm-set-sp (tm-fetch (tm-incrn-address ('1,

addr),

tm),

tm-set-cc (tm-unpack-cc (tm-fetch (tm-incrn-address ('2,

addr),

tm)),

tm-set-error (tm-unpack-error (tm-fetch (tm-incrn-address ('2,

addr),

tm)), tm-set-svcflag (tm-unpack-svcflag (tm-fetch (tm-incrn-address ('2,

addr),

tm)), tm-set-svcid (tm-unpack-svcid (tm-fetch (tm-incrn-address ('2,

addr),

tm)),

tm)))))))

else tm-set-error ('3, tm) endif

Definition: tm-execute-mod (addr1 , addr2 , tm) = tm-store (alu-value (tm-alu-mod (tm-fetch (addr1 , tm), tm-fetch (addr2 , tm))),

addr1 ,

tm-set-cc (tm-cc-value (tm-alu-mod (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

tm))

Definition: tm-execute-move (addr1 , addr2 , tm) = tm-store (tm-fetch (addr2 , tm), addr1 , tm)

Definition: tm-execute-multiply (addr1 , addr2 , tm) = tm-store (alu-value (tm-alu-mult (tm-fetch (addr1 , tm), tm-fetch (addr2 , tm))),

addr1 ,

tm-set-cc (tm-cc-value (tm-alu-mult (tm-fetch (addr1 , tm),

tm-fetch (addr2 , tm))),

tm))

Definition: tm-execute-post-output-interrupt (addr, tm) = if tm-in-supervisor-mode (tm)

then tm-set-oports (tm-post-output-interrupt (tm-fetch (addr, tm),

tm-oports (tm)),

tm)

else tm-set-error ('3, tm) endif

Definition: tm-execute-return (tm) = if tm-stack-underflowp (tm) then tm-set-error ('5, tm)

else tm-set-pc (tm-fetch (real-addr ('2, tm-incr (tm-sp (tm))), tm), tm-set-sp (tm-incr (tm-sp (tm)), tm)) endif

Definition: tm-execute-run (tm) = if tm-in-supervisor-mode (tm) then tm-set-rwstate ('0, tm)

else tm-set-error ('3, tm) endif

Definition: tm-execute-set-clock (addr, tm) = if tm-in-supervisor-mode (tm) then tm-set-clock (tm-fetch (addr, tm), tm)

else tm-set-error ('3, tm) endif

Definition: tm-execute-start-output (addr1 , addr2 , tm) = if tm-in-supervisor-mode (tm)

then tm-set-oports (tm-start-output (tm-fetch (addr2 , tm), tm-fetch (addr1 , tm), tm-oports (tm)),

tm)

else tm-set-error ('3, tm) endif

Definition: tm-execute-svc (addr, tm) = if tm-in-supervisor-mode (tm) then tm

else tm-set-svcflag ('1,

tm-set-svcid (tm-fetch (addr, tm) mod '128, tm)) endif

Definition: tm-execute-svc-return (addr, tm) = if tm-in-supervisor-mode (tm)

then tm-set-svmode ('0,

tm-set-pc (tm-fetch (addr, tm),

tm-set-sp (tm-fetch (tm-incrn-address ('1,

addr),

tm),

tm-set-cc (tm-unpack-cc (tm-fetch (tm-incrn-address ('2,

addr),

tm)),

tm-set-error (tm-unpack-error (tm-fetch (tm-incrn-address ('2,

addr),

tm)),

tm-set-svcflag ('0,

tm-set-svcid (tm-unpack-svcid (tm-fetch (tm-incrn-address ('2,

addr),

tm)),

tm)))))))

else tm-set-error ('3, tm) endif

Definition: tm-execute-test-iport (addr, tm) = if tm-in-supervisor-mode (tm)

then if tm-iport-errorp (tm-fetch (addr, tm) mod '16, tm-iports (tm)) then tm-set-cc ('1, tm) else tm-set-cc ('0, tm) endif

else tm-set-error ('3, tm) endif

Definition: tm-execute-test-oport (addr, tm) = if tm-in-supervisor-mode (tm)

then if tm-oport-idlep (tm-fetch (addr, tm) mod '16, tm-oports (tm)) then tm-set-cc ('1, tm) else tm-set-cc ('0, tm) endif

else tm-set-error ('3, tm) endif

Definition: tm-execute-wait (tm)

= if tm-in-supervisor-mode (tm)

then tm-set-rwstate ('1, tm-set-svmode ('0, tm))

else tm-set-error ('3, tm) endif Definition: tm-opcode-size = '6 Definition: tm-mode-size = '2 Definition: tm-index-size = '3 Definition: tm-opcode-divisor = '64 Definition: tm-mode1-divisor = '256 Definition: tm-index1-divisor = '2048 Definition: tm-mode2-divisor = '8192 Definition: tm-opcode (instruction) = (instruction mod '64) Definition: tm-mode1 (instruction) = ((instruction mod '256) ÷ '64) Definition: tm-index1 (instruction) = ((instruction mod '2048) ÷ '256) Definition: tm-mode2 (instruction) = ((instruction mod '8192) ÷ '2048) Definition: tm-index2 (instruction) = (instruction ÷ '8192) Definition: tm-nullary-instructionp (instruction) = ((tm-opcode (instruction) mod '4) = '0) Definition: tm-unary-instructionp (instruction) = ((tm-opcode (instruction) mod '2) = '0) Definition: tm-datum1 (instruction-list) = car (cdr (instruction-list)) Definition: tm-datum2 (instruction-list) = car (cdr (cdr (instruction-list))) Definition: tm-arg1 (instruction-list) = cons (tm-mode1 (car (instruction-list)),

cons (tm-datum1 (instruction-list), cons (tm-index1 (car (instruction-list)), 'nil)))

Definition: tm-arg2 (instruction-list) = cons (tm-mode2 (car (instruction-list)),

cons (tm-datum2 (instruction-list),

cons (tm-index2 (car (instruction-list)), 'nil)))

Definition: tm-return-opcode = '0 Definition: tm-wait-opcode = '4 Definition: tm-run-opcode = '8 Definition: tm-execute-nullary (opcode, tm) = if opcode = '0 then tm-execute-return (tm)

elseif opcode = '8 then tm-execute-run (tm) elseif opcode = '4 then tm-execute-wait (tm) else tm-set-error ('2, tm) endif

Definition: tm-br-opcode = '2 Definition: tm-brnz-opcode = '6 Definition: tm-brz-opcode = '10 Definition: tm-call-opcode = '14 Definition: tm-decr-opcode = '18 Definition: tm-incr-opcode = '22 Definition: tm-lbase-opcode = '26 Definition: tm-llimit-opcode = '30 Definition: tm-lpsw-opcode = '34 Definition: tm-post-opcode = '38 Definition: tm-svc-opcode = '42 Definition: tm-svc-return-opcode = '46 Definition: tm-testi-opcode = '50 Definition: tm-testo-opcode = '54 Definition: tm-time-opcode = '58 Definition: tm-execute-unary (opcode, addr, tm) = if ¬ tm-good-address (addr, tm) then tm-set-error ('6, tm)

elseif opcode = '2 then tm-execute-branch (addr, tm) elseif opcode = '10 then tm-execute-branch-on-zero (addr, tm) elseif opcode = '6 then tm-execute-branch-not-zero (addr, tm) elseif opcode = '14 then tm-execute-call (addr, tm) elseif opcode = '18 then tm-execute-decr (addr, tm) elseif opcode = '22 then tm-execute-incr (addr, tm) elseif opcode = '26 then tm-execute-load-base (addr, tm) elseif opcode = '30 then tm-execute-load-limit (addr, tm) elseif opcode = '34 then tm-execute-load-psw (addr, tm) elseif opcode = '58 then tm-execute-set-clock (addr, tm) elseif opcode = '50 then tm-execute-test-iport (addr, tm) elseif opcode = '54 then tm-execute-test-oport (addr, tm) elseif opcode = '42 then tm-execute-svc (addr, tm) elseif opcode = '46 then tm-execute-svc-return (addr, tm) elseif opcode = '38 then tm-execute-post-output-interrupt (addr, tm) else tm-set-error ('2, tm) endif

Definition: tm-add-opcode = '1

Definition: tm-compare-opcode = '3

Definition: tm-decr-mod-opcode = '5

Definition: tm-incr-mod-opcode = '7

Definition: tm-mod-opcode = '9

Definition: tm-move-opcode = '11

Definition: tm-mult-opcode = '13

Definition: tm-stout-opcode = '15

Definition: tm-execute-binary (opcode, addr1 , addr2 , tm) = if (¬ tm-good-address (addr1 , tm))

∨ (¬ tm-good-address (addr2 , tm)) then tm-set-error ('6, tm) elseif opcode = '1 then tm-execute-add (addr1 , addr2 , tm) elseif opcode = '3 then tm-execute-compare (addr1 , addr2 , tm) elseif opcode = '5 then tm-execute-decr-mod (addr1 , addr2 , tm) elseif opcode = '7 then tm-execute-incr-mod (addr1 , addr2 , tm) elseif opcode = '9 then tm-execute-mod (addr1 , addr2 , tm) elseif opcode = '11 then tm-execute-move (addr1 , addr2 , tm) elseif opcode = '13 then tm-execute-multiply (addr1 , addr2 , tm) elseif opcode = '15 then tm-execute-start-output (addr1 , addr2 , tm) else tm-set-error ('2, tm) endif

Definition: tm-execute-instruction (instruction, tm) = if length (instruction) = '1

then tm-execute-nullary (tm-opcode (car (instruction)), tm) elseif length (instruction) = '2 then tm-execute-unary (tm-opcode (car (instruction)),

tm-compute-address (tm-arg1 (instruction), tm), tm)

elseif length (instruction) = '3 then tm-execute-binary (tm-opcode (car (instruction)),

tm-compute-address (tm-arg1 (instruction), tm), tm-compute-address (tm-arg2 (instruction), tm), tm)

else tm-set-error ('2, tm) endif

Definition: tm-fetch-opcode (tm) = tm-fetch (real-addr ('2, tm-pc (tm)), tm)

Definition: tm-fetch-arg1 (tm) = tm-fetch (real-addr ('2, tm-incrn ('1, tm-pc (tm))), tm)

Definition: tm-fetch-arg2 (tm) = tm-fetch (real-addr ('2, tm-incrn ('2, tm-pc (tm))), tm)

Definition: tm-execute (opcode, tm) = if tm-nullary-instructionp (opcode)

then tm-execute-instruction (cons (opcode, 'nil),

tm-set-pc (tm-incrn ('1, tm-pc (tm)), tm))

elseif tm-good-address (real-addr ('2, tm-incrn ('1, tm-pc (tm))), tm) then if tm-unary-instructionp (opcode)

then tm-execute-instruction (cons (opcode,

cons (tm-fetch-arg1 (tm), 'nil)), tm-set-pc (tm-incrn ('2, tm-pc (tm)), tm))

elseif tm-good-address (real-addr ('2, tm-incrn ('2, tm-pc (tm))), tm) then tm-execute-instruction (cons (opcode,

cons (tm-fetch-arg1 (tm),

cons (tm-fetch-arg2 (tm),

                                            'nil))),

tm-set-pc (tm-incrn ('3, tm-pc (tm)), tm))

else tm-set-error ('7, tm) endif else tm-set-error ('7, tm) endif Definition: tm-decrement-clock (tm) = if tm-clock (tm) ≃ 0 then tm

elseif ¬ tm-in-supervisor-mode (tm)

then tm-set-clock (tm-decr (tm-clock (tm)), tm)

else tm endif

Definition: tm-good-pc-address (tm) = tm-good-address (real-addr ('2, tm-pc (tm)), tm)

Definition: tm-fetch-execute (tm) = if tm-good-pc-address (tm)

then tm-execute (tm-fetch-opcode (tm), tm-decrement-clock (tm))

else tm-set-error ('7, tm-decrement-clock (tm)) endif

Definition: tm-fetch-new-pc-on-interrupt (addr, tm) = tm-set-pc (tm-fetch-from-memory (addr, tm), tm)

Definition: tm-store-old-psw-on-interrupt (addr, tm) = tm-store (tm-pc (tm),

real-addr ('2, addr), tm-store (tm-sp (tm),

tm-incrn-address ('1, real-addr ('2, addr)), tm-store (tm-pack-psw (tm-cc (tm),

tm-error (tm), tm-svcflag (tm), tm-svcid (tm)), tm-incrn-address ('2, real-addr ('2, addr)), tm)))

Definition: tm-clock-interruptp (tm) = ((¬ tm-in-supervisor-mode (tm)) ∧ (tm-clock (tm) ≃ 0))

Definition: tm-execute-clock-interrupt (tm) = tm-set-sp (tm-decr (tm-slimit (tm)),

tm-fetch-new-pc-on-interrupt ('3,

tm-store-old-psw-on-interrupt ('0,

tm-set-svmode ('1, tm))))

Definition: tm-errorp (tm) = (tm-error (tm) ≠ '0)

Definition: tm-execute-error-interrupt (tm) = tm-set-sp (tm-decr (tm-slimit (tm)),

tm-set-error ('0,

tm-fetch-new-pc-on-interrupt ('4,

tm-store-old-psw-on-interrupt ('0,

tm-set-svmode ('1, tm)))))

Definition: tm-svc-interruptp (tm) = ((¬ tm-in-supervisor-mode (tm)) ∧ (tm-svcflag (tm) = '1))

Definition: tm-store-svcid-on-interrupt (tm) = tm-store (tm-svcid (tm), '(2 8), tm)

Definition: tm-execute-svc-interrupt (tm) = tm-set-sp (tm-decr (tm-slimit (tm)),

tm-fetch-new-pc-on-interrupt ('5,

tm-store-svcid-on-interrupt (tm-store-old-psw-on-interrupt ('0,

tm-set-svmode ('1, tm)))))

Definition: tm-overflow-char (char) = ('256 + char)

Definition: tm-some-input-interruptp (ports) = if listp (ports)

then (tm-iinterrupt-flag (car (ports)) = '1)

∨ tm-some-input-interruptp (cdr (ports))

    else '*1*false endif

Definition: tm-input-interruptp (tm) = ((¬ tm-in-supervisor-mode (tm))

∧ tm-some-input-interruptp (tm-iports (tm)))

Definition: tm-interrupting-input-port (ports) = if listp (ports)

then if tm-iinterrupt-flag (car (ports)) = '1 then '0

else 1 + tm-interrupting-input-port (cdr (ports)) endif else '0 endif Definition: tm-store-interrupting-input-device (id, tm) = tm-store (id,

            '(2 8),

tm-store (tm-ichar (getnth (id, tm-iports (tm))), '(2 9), tm))

Definition: tm-execute-input-interrupt (tm) = tm-set-sp (tm-decr (tm-slimit (tm)),

tm-set-error ('0,

tm-fetch-new-pc-on-interrupt ('6,

tm-set-iports (tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (tm)),

tm-iports (tm)),

tm-store-interrupting-input-device (tm-interrupting-input-port (tm-iports (tm)),

tm-store-old-psw-on-interrupt ('0,

tm-set-svmode ('1,

tm-set-rwstate ('0, tm))))))))

Definition: tm-some-output-interruptp (ports) = if listp (ports)

then (tm-ointerrupt-flag (car (ports)) = '1)

∨ tm-some-output-interruptp (cdr (ports))

    else '*1*false endif

Definition: tm-output-interruptp (tm) = ((¬ tm-in-supervisor-mode (tm))

∧ tm-some-output-interruptp (tm-oports (tm)))

Definition: tm-interrupting-output-port (ports) = if listp (ports)

then if tm-ointerrupt-flag (car (ports)) = '1 then '0

else 1 + tm-interrupting-output-port (cdr (ports)) endif else '0 endif

Definition: tm-store-interrupting-output-device (id, tm) = tm-store (id, '(2 9), tm)

Definition: tm-execute-output-interrupt (tm) = tm-set-sp (tm-decr (tm-slimit (tm)),

tm-set-error ('0, tm-fetch-new-pc-on-interrupt ('7,

tm-set-oports (tm-clear-output-interrupt (tm-interrupting-output-port (tm-oports (tm)),

tm-oports (tm)),

tm-store-interrupting-output-device (tm-interrupting-output-port (tm-oports (tm)),

tm-store-old-psw-on-interrupt ('0,

tm-set-svmode ('1,

tm-set-rwstate ('0, tm))))))))

Event: Add the shell tm-device-input-event, with recognizer function symbol tm-device-input-eventp and 2 accessors: tm-idevid, with type restriction (none-of) and default value zero; tm-idatum, with type restriction (none-of) and default value zero.

Event: Add the shell tm-device-output-event, with recognizer function symbol tm-device-output-eventp and 1 accessor: tm-odevid, with type restriction (noneof) and default value zero.

Definition: tm-post-interrupt (event, tm) = if tm-device-input-eventp (event)

then tm-set-iports (tm-post-input-interrupt (tm-idatum (event)

                                         mod '256,

tm-idevid (event) mod '16, tm-iports (tm)),

tm) elseif tm-device-output-eventp (event) then tm-set-oports (tm-post-output-interrupt (tm-odevid (event)

mod '16, tm-oports (tm)),

tm)

else tm endif

Definition: tm-step (tm) = if tm-input-interruptp (tm) then tm-execute-input-interrupt (tm)

elseif tm-output-interruptp (tm) then tm-execute-output-interrupt (tm) elseif tm-waiting (tm) then tm elseif tm-errorp (tm) then tm-execute-error-interrupt (tm) elseif tm-clock-interruptp (tm) then tm-execute-clock-interrupt (tm) elseif tm-svc-interruptp (tm) then tm-execute-svc-interrupt (tm) else tm-fetch-execute (tm) endif

Definition: tm-processor (tm, oracle) = if listp (oracle)

then tm-processor (tm-step (tm-post-interrupt (car (oracle), tm)),

cdr (oracle))

else tm endif

Theorem: tm-processor-with-null-oracle tm-processor (tm, 'nil) = tm

Event: Disable tm-processor-with-null-oracle.

Theorem: open-up-tm-processor tm-processor (tm, cons (a, b)) = tm-processor (tm-step (tm-post-interrupt (a, tm)), b)

Event: Disable open-up-tm-processor.

Theorem: tm-processor-append-oracle tm-processor (tm, append (a, b)) = tm-processor (tm-processor (tm, a), b)

Event: Disable tm-processor-append-oracle.

Theorem: finite-numberp-tm-cc-value finite-numberp (tm-cc-value (x), '4)

Event: Disable finite-numberp-tm-cc-value.

Theorem: lessp-tm-cc-value-tm-cclub (tm-cc-value (x) < '4) = '*1*true

Event: Disable lessp-tm-cc-value-tm-cclub.

Theorem: lessp-tm-cc-value-tm-cclub-linear tm-cc-value (x) < '4

Event: Disable lessp-tm-cc-value-tm-cclub-linear.

Theorem: tm-cc-value-on-compare-equal (finite-numberp (a, '65536) ∧ (finite-numberp (b, '65536) ∧ (a = b))) → (tm-cc-value (tm-alu-difference (a, b)) = '1)

Event: Disable tm-cc-value-on-compare-equal.

Theorem: tm-cc-value-on-compare-greaterp ((b < a) ∧ (a < '65536)) → (tm-cc-value (tm-alu-difference (a, b)) = '2)

Event: Disable tm-cc-value-on-compare-greaterp.

Theorem: tm-cc-value-on-compare-lessp ((a < b) ∧ (b < '65536)) → (tm-cc-value (tm-alu-difference (a, b)) = '0)

Event: Disable tm-cc-value-on-compare-lessp.

Theorem: tm-cc-value-on-compare-not-equal (finite-numberp (a, '65536) ∧ (finite-numberp (b, '65536) ∧ (a ≠ b))) → ((tm-cc-value (tm-alu-difference (a, b)) = '1) = '*1*false)

Event: Disable tm-cc-value-on-compare-not-equal.

Theorem: tm-cc-value-on-compare-not-equal-to-zero (finite-numberp (a, '65536) ∧ (a ≠ '0)) → (tm-cc-value (tm-alu-difference (a, '0)) = '2)

Event: Disable tm-cc-value-on-compare-not-equal-to-zero.

Theorem: numberp-tm-fix-word tm-fix-word (n) ∈ N

Event: Disable numberp-tm-fix-word.

Theorem: tm-fix-word-size (tm-fix-word (n) < '65536) = '*1*true

Event: Disable tm-fix-word-size.

Theorem: tm-fix-word-size-linear tm-fix-word (n) < '65536

Event: Disable tm-fix-word-size-linear.

Theorem: tm-fix-word-noop (n < '65536) → (tm-fix-word (n) = fix (n))

Event: Disable tm-fix-word-noop.

Theorem: numberp-tm-fix-reg-address tm-fix-reg-address (n) ∈ N

Event: Disable numberp-tm-fix-reg-address.

Theorem: tm-fix-reg-address-size (tm-fix-reg-address (n) < '8) = '*1*true

Event: Disable tm-fix-reg-address-size.

Theorem: tm-fix-reg-address-size-linear tm-fix-reg-address (n) < '8

Event: Disable tm-fix-reg-address-size-linear.

Theorem: tm-fix-reg-address-noop (n < '8) → (tm-fix-reg-address (n) = fix (n))

Event: Disable tm-fix-reg-address-noop.

Definition: good-tm-iport (x) = (tm-iportp (x)

∧ (finite-numberp (tm-iinterrupt-flag (x), '2)

∧ (finite-numberp (tm-ierror-flag (x), '2) ∧ finite-numberp (tm-ichar (x), '256))))

Definition: good-tm-iport-array (l) = if listp (l)

then good-tm-iport (car (l)) ∧ good-tm-iport-array (cdr (l)) else '*1*true endif

Definition: good-tm-oport (x) = (tm-oportp (x)

∧ (finite-numberp (tm-ointerrupt-flag (x), '2)

∧ (finite-numberp (tm-obusy-flag (x), '2) ∧ finite-numberp (tm-ochar (x), '256))))

Definition: good-tm-oport-array (l) = if listp (l)

then good-tm-oport (car (l)) ∧ good-tm-oport-array (cdr (l)) else '*1*true endif

(DEFN GOOD-TM
 (TM)
 (AND
  (TM-SHELLP TM)
  (AND
   (PLISTP (TM-MEMORY TM))
   (AND
    (EQUAL (LENGTH (TM-MEMORY TM))
           '65536)
    (AND
     (FINITE-NUMBER-LISTP (TM-MEMORY TM)
                          '65536)
     (AND
      (PLISTP (TM-REGS TM))
      (AND
       (EQUAL (LENGTH (TM-REGS TM)) '8)
       (AND
        (FINITE-NUMBER-LISTP (TM-REGS TM)
                             '65536)
        (AND
         (FINITE-NUMBERP (TM-CC TM) '4)
         (AND
          (FINITE-NUMBERP (TM-ERROR TM) '64)
          (AND
           (FINITE-NUMBERP (TM-SVCFLAG TM) '2)
           (AND
            (FINITE-NUMBERP (TM-SVCID TM) '128)
            (AND
             (FINITE-NUMBERP (TM-BASE TM) '65536)
             (AND
              (FINITE-NUMBERP (TM-LIMIT TM) '65536)
              (AND
               (FINITE-NUMBERP (TM-SLIMIT TM)
                               '65536)
               (AND
                (FINITE-NUMBERP (TM-SVMODE TM) '2)

                (AND
                 (FINITE-NUMBERP (TM-RWSTATE TM) '2)
                 (AND
                  (FINITE-NUMBERP (TM-CLOCK TM) '65536)
                  (AND
                   (PLISTP (TM-IPORTS TM))
                   (AND
                    (EQUAL (LENGTH (TM-IPORTS TM)) '16)
                    (AND
                     (GOOD-TM-IPORT-ARRAY (TM-IPORTS TM))
                     (AND
                      (PLISTP (TM-OPORTS TM))
                      (AND
                       (EQUAL (LENGTH (TM-OPORTS TM)) '16)
                       (GOOD-TM-OPORT-ARRAY
                                          (TM-OPORTS TM))))))))))))))))))))))))
 NIL)

Theorem: tm-shellp-tm good-tm (tm) → tm-shellp (tm)

Event: Disable tm-shellp-tm.

Theorem: plistp-tm-memory good-tm (tm) → plistp (tm-memory (tm))

Event: Disable plistp-tm-memory.

Theorem: length-tm-memory good-tm (tm) → (length (tm-memory (tm)) = '65536)

Event: Disable length-tm-memory.

Theorem: finite-number-listp-tm-memory good-tm (tm) → finite-number-listp (tm-memory (tm), '65536)

Event: Disable finite-number-listp-tm-memory.

Theorem: numberp-getnth-from-tm-memory (good-tm (tm) ∧ (i < '65536)) → (getnth (i, tm-memory (tm)) ∈ N)

Event: Disable numberp-getnth-from-tm-memory.

Theorem: plistp-tm-regs good-tm (tm) → plistp (tm-regs (tm))

Event: Disable plistp-tm-regs.

Theorem: length-tm-regs good-tm (tm) → (length (tm-regs (tm)) = '8)

Event: Disable length-tm-regs.

Theorem: finite-number-listp-tm-regs good-tm (tm) → finite-number-listp (tm-regs (tm), '65536)

Event: Disable finite-number-listp-tm-regs.

Theorem: numberp-getnth-from-tm-regs (good-tm (tm) ∧ (i < '8)) → (getnth (i, tm-regs (tm)) ∈ N)

Event: Disable numberp-getnth-from-tm-regs.

Theorem: finite-numberp-tm-cc good-tm (tm) → finite-numberp (tm-cc (tm), '4)

Event: Disable finite-numberp-tm-cc.

Theorem: finite-numberp-tm-error good-tm (tm) → finite-numberp (tm-error (tm), '64)

Event: Disable finite-numberp-tm-error.

Theorem: finite-numberp-tm-base good-tm (tm) → finite-numberp (tm-base (tm), '65536)

Event: Disable finite-numberp-tm-base.

Theorem: finite-numberp-tm-limit good-tm (tm) → finite-numberp (tm-limit (tm), '65536)

Event: Disable finite-numberp-tm-limit.

Theorem: finite-numberp-tm-slimit good-tm (tm) → finite-numberp (tm-slimit (tm), '65536)

Event: Disable finite-numberp-tm-slimit.

Theorem: finite-numberp-tm-svmode good-tm (tm) → finite-numberp (tm-svmode (tm), '2)

Event: Disable finite-numberp-tm-svmode.

Theorem: finite-numberp-tm-clock good-tm (tm) → finite-numberp (tm-clock (tm), '65536)

Event: Disable finite-numberp-tm-clock.

Theorem: finite-numberp-tm-pc good-tm (tm) → finite-numberp (tm-pc (tm), '65536)

Event: Disable finite-numberp-tm-pc.

Theorem: finite-numberp-tm-sp good-tm (tm) → finite-numberp (tm-sp (tm), '65536)

Event: Disable finite-numberp-tm-sp.

Theorem: finite-numberp-tm-pack-psw good-tm (tm) → finite-numberp (tm-pack-psw (tm-cc (tm),

tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                  '65536)

Event: Disable finite-numberp-tm-pack-psw.

Theorem: finite-numberp-tm-svcflag good-tm (tm) → finite-numberp (tm-svcflag (tm), '2)

Event: Disable finite-numberp-tm-svcflag.

Theorem: finite-numberp-tm-svcid good-tm (tm) → finite-numberp (tm-svcid (tm), '128)

Event: Disable finite-numberp-tm-svcid.

Theorem: finite-numberp-tm-rwstate good-tm (tm) → finite-numberp (tm-rwstate (tm), '2)

Event: Disable finite-numberp-tm-rwstate.

Theorem: plistp-tm-iports good-tm (tm) → plistp (tm-iports (tm))

Event: Disable plistp-tm-iports.

Theorem: length-tm-iports good-tm (tm) → (length (tm-iports (tm)) = '16)

Event: Disable length-tm-iports.

Theorem: good-tm-iport-array-tm-iports good-tm (tm) → good-tm-iport-array (tm-iports (tm))

Event: Disable good-tm-iport-array-tm-iports.

Theorem: plistp-tm-oports good-tm (tm) → plistp (tm-oports (tm))

Event: Disable plistp-tm-oports.

Theorem: length-tm-oports good-tm (tm) → (length (tm-oports (tm)) = '16)

Event: Disable length-tm-oports.

Theorem: good-tm-oport-array-tm-oports good-tm (tm) → good-tm-oport-array (tm-oports (tm))

Event: Disable good-tm-oport-array-tm-oports.

Theorem: good-tm-iport-getnth (good-tm-iport-array (l) ∧ (i < length (l))) → good-tm-iport (getnth (i, l))

Event: Disable good-tm-iport-getnth.

Theorem: good-tm-iport-array-putnth (good-tm-iport-array (l) ∧ good-tm-iport (iport)) → good-tm-iport-array (putnth (iport, n, l))

Event: Disable good-tm-iport-array-putnth.

Theorem: good-tm-iport-getnth-from-tm-iports (good-tm (tm) ∧ finite-numberp (id, '16)) → good-tm-iport (getnth (id, tm-iports (tm)))

Event: Disable good-tm-iport-getnth-from-tm-iports.

Theorem: good-tm-iport-array-putnth-into-tm-iports (good-tm (tm) ∧ good-tm-iport (iport)) → good-tm-iport-array (putnth (iport, n, tm-iports (tm)))

Event: Disable good-tm-iport-array-putnth-into-tm-iports.

Theorem: good-tm-oport-getnth (good-tm-oport-array (l) ∧ (i < length (l))) → good-tm-oport (getnth (i, l))

Event: Disable good-tm-oport-getnth.

Theorem: good-tm-oport-array-putnth (good-tm-oport-array (l) ∧ good-tm-oport (oport)) → good-tm-oport-array (putnth (oport, n, l))

Event: Disable good-tm-oport-array-putnth.

Theorem: good-tm-oport-getnth-from-tm-oports (good-tm (tm) ∧ finite-numberp (id, '16)) → good-tm-oport (getnth (id, tm-oports (tm)))

Event: Disable good-tm-oport-getnth-from-tm-oports.

Theorem: good-tm-oport-array-putnth-into-tm-oports (good-tm (tm) ∧ good-tm-oport (oport)) → good-tm-oport-array (putnth (oport, n, tm-oports (tm)))

Event: Disable good-tm-oport-array-putnth-into-tm-oports.

Theorem: size-of-tm-interrupting-input-port tm-some-input-interruptp (l) → (tm-interrupting-input-port (l) < length (l))

Event: Disable size-of-tm-interrupting-input-port.

Theorem: finite-numberp-tm-interrupting-input-port (good-tm (tm) ∧ tm-some-input-interruptp (tm-iports (tm))) → finite-numberp (tm-interrupting-input-port (tm-iports (tm)), '16)

Event: Disable finite-numberp-tm-interrupting-input-port.

Theorem: finite-numberp-tm-interrupting-input-port-tm-wordlub (good-tm (tm) ∧ tm-some-input-interruptp (tm-iports (tm))) → finite-numberp (tm-interrupting-input-port (tm-iports (tm)), '65536)

Event: Disable finite-numberp-tm-interrupting-input-port-tm-wordlub.

Theorem: good-tm-iport-getnth-properties (good-tm (tm) ∧ finite-numberp (id, '16)) → (tm-iportp (getnth (id, tm-iports (tm)))

∧ (finite-numberp (tm-iinterrupt-flag (getnth (id, tm-iports (tm))),

                       '2)

∧ (finite-numberp (tm-ierror-flag (getnth (id,

tm-iports (tm))),

                           '2)

∧ finite-numberp (tm-ichar (getnth (id,

tm-iports (tm))),

                              '256))))

Event: Disable good-tm-iport-getnth-properties.

Theorem: size-of-tm-interrupting-output-port tm-some-output-interruptp (l) → (tm-interrupting-output-port (l) < length (l))

Event: Disable size-of-tm-interrupting-output-port.

Theorem: finite-numberp-tm-interrupting-output-port (good-tm (tm) ∧ tm-some-output-interruptp (tm-oports (tm))) → finite-numberp (tm-interrupting-output-port (tm-oports (tm)), '16)

Event: Disable finite-numberp-tm-interrupting-output-port.

Theorem: finite-numberp-tm-interrupting-output-port-tm-wordlub (good-tm (tm) ∧ tm-some-output-interruptp (tm-oports (tm))) → finite-numberp (tm-interrupting-output-port (tm-oports (tm)), '65536)

Event: Disable finite-numberp-tm-interrupting-output-port-tm-wordlub.

Theorem: good-tm-oport-getnth-properties (good-tm (tm) ∧ finite-numberp (id, '16)) → (tm-oportp (getnth (id, tm-oports (tm)))

∧ (finite-numberp (tm-ointerrupt-flag (getnth (id, tm-oports (tm))),

                       '2)

∧ (finite-numberp (tm-obusy-flag (getnth (id, tm-oports (tm))),

                           '2)

∧ finite-numberp (tm-ochar (getnth (id,

tm-oports (tm))),

                              '256))))

Event: Disable good-tm-oport-getnth-properties.

Event: Let us define the theory tm-shells to consist of the following events: tm-device-output-event, tm-device-input-event, tm-oport, tm-iport, tm.

Theorem: good-tm-iports-tm-clear-input-interrupt (good-tm (tm) ∧ finite-numberp (id, '16)) → (plistp (tm-clear-input-interrupt (id, tm-iports (tm)))

∧ ((length (tm-clear-input-interrupt (id, tm-iports (tm))) = '16) ∧ good-tm-iport-array (tm-clear-input-interrupt (id,

tm-iports (tm)))))

Event: Disable good-tm-iports-tm-clear-input-interrupt.

Theorem: good-tm-oports-tm-clear-output-interrupt (good-tm (tm) ∧ finite-numberp (id, '16)) → (plistp (tm-clear-output-interrupt (id, tm-oports (tm)))

∧ ((length (tm-clear-output-interrupt (id, tm-oports (tm)))

          = '16)

∧ good-tm-oport-array (tm-clear-output-interrupt (id, tm-oports (tm)))))

Event: Disable good-tm-oports-tm-clear-output-interrupt.

Theorem: finite-numberp-tm-ichar-getnth-crock (good-tm (tm) ∧ finite-numberp (id, '16)) → finite-numberp (tm-ichar (getnth (id, tm-iports (tm))), '65536)

Event: Disable finite-numberp-tm-ichar-getnth-crock.

Theorem: finite-numberp-tm-overflow-char finite-numberp (char, '256) → finite-numberp (tm-overflow-char (char), '512)

Theorem: finite-numberp-tm-overflow-char-tm-wordlub finite-numberp (char, '256) → finite-numberp (tm-overflow-char (char), '65536)

Event: Disable finite-numberp-tm-overflow-char-tm-wordlub.

Theorem: tm-iport-error-flag-is-zero (good-tm (tm) ∧ ((id ∈ N)

∧ ((id < '16) ∧ (¬ tm-iport-errorp (id, tm-iports (tm)))))) → (tm-ierror-flag (getnth (id, tm-iports (tm))) = '0)

Event: Disable tm-iport-error-flag-is-zero.

Theorem: finite-numberp-tm-interrupting-input-port-crock (good-tm (os) ∧ tm-some-input-interruptp (tm-iports (os))) → ((tm-interrupting-input-port (tm-iports (os)) ∈ N)

∧ (tm-interrupting-input-port (tm-iports (os)) < '16))

Event: Disable finite-numberp-tm-interrupting-input-port-crock.

Theorem: tm-ichar-facts (good-tm (os) ∧ tm-some-input-interruptp (tm-iports (os)))

→ ((('256

+ tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))

      < '65536)
     = '*1*true)

Event: Disable tm-ichar-facts.

Theorem: finite-numberp-tm-interrupting-output-port-crock (good-tm (os) ∧ tm-some-output-interruptp (tm-oports (os))) → ((tm-interrupting-output-port (tm-oports (os)) ∈ N)

∧ (tm-interrupting-output-port (tm-oports (os)) < '16))

Event: Disable finite-numberp-tm-interrupting-output-port-crock.

Definition: tm-cpu-length = '9

Definition: tm-r0 (tm) = getnth ('0, tm-regs (tm))

Definition: tm-r1 (tm) = getnth ('1, tm-regs (tm))

Definition: tm-r2 (tm) = getnth ('2, tm-regs (tm))

Definition: tm-r3 (tm) = getnth ('3, tm-regs (tm))

Definition: tm-r4 (tm) = getnth ('4, tm-regs (tm))

Definition: tm-r5 (tm) = getnth ('5, tm-regs (tm))

Definition: tm-r6 (tm) = getnth ('6, tm-regs (tm))

Definition: tm-r7 (tm) = getnth ('7, tm-regs (tm))

Definition: tm-cpu (tm) = cons (tm-r0 (tm),

cons (tm-r1 (tm),

cons (tm-r2 (tm),

cons (tm-r3 (tm),

cons (tm-r4 (tm),

cons (tm-r5 (tm),

cons (tm-r6 (tm),

cons (tm-r7 (tm),

cons (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

'nil)))))))))

Definition: good-cpu (cpu) = (plistp (cpu)

∧ ((length (cpu) = '9) ∧ finite-number-listp (cpu, '65536)))

Definition: good-cpu-list (l) = if listp (l) then good-cpu (car (l)) ∧ good-cpu-list (cdr (l))

else '*1*true endif Theorem: open-up-finite-number-listp finite-number-listp (cons (a, b), lub) = (finite-numberp (a, lub) ∧ finite-number-listp (b, lub))

Event: Disable open-up-finite-number-listp.

Theorem: finite-number-listp-on-non-list (¬ listp (x)) → (finite-number-listp (x, lub) = '*1*true)

Event: Disable finite-number-listp-on-non-list.

Theorem: length-tm-cpu good-tm (tm) → (length (tm-cpu (tm)) = '9)

Event: Disable length-tm-cpu.

Theorem: plistp-tm-cpu plistp (tm-cpu (tm))

Event: Disable plistp-tm-cpu.

Theorem: finite-number-listp-tm-cpu good-tm (tm) → finite-number-listp (tm-cpu (tm), '65536)

Event: Disable finite-number-listp-tm-cpu.

Theorem: good-cpu-tm-cpu good-tm (tm) → good-cpu (tm-cpu (tm))

Event: Disable good-cpu-tm-cpu.

Theorem: good-cpu-getnth (good-cpu-list (l) ∧ (n < length (l))) → good-cpu (getnth (n, l))

Event: Disable good-cpu-getnth.

Theorem: good-cpu-list-putnth (good-cpu-list (l) ∧ good-cpu (cpu)) → good-cpu-list (putnth (cpu, i, l))

Event: Disable good-cpu-list-putnth.

Theorem: list-of-getnths8 (plistp (l) ∧ (length (l) = '8)) → (cons (getnth ('0, l),

cons (getnth ('1, l),

cons (getnth ('2, l),

cons (getnth ('3, l),

cons (getnth ('4, l),

cons (getnth ('5, l),

cons (getnth ('6, l),

cons (getnth ('7, l), 'nil))))))))

= l)

Event: Disable list-of-getnths8.

Theorem: cpu-regs-segment good-tm (tm) → (getseg ('0, '8, tm-cpu (tm)) = tm-regs (tm))

Event: Disable cpu-regs-segment.

Event: Let us define the theory good-tm-properties to consist of the following events: cpu-regs-segment, good-cpu-list-putnth, good-cpu-getnth, good-cpu-tm-cpu, finite-numberp-tm-pack-psw, finite-number-listp-tm-cpu, numberp-getnth-from-tm-regs, numberp-getnth-from-tm-memory, finite-numberp-tm-pc, finitenumberp-tm-sp, finite-numberp-tm-cc, finite-numberp-tm-error, finite-numberp-tm-svcflag, finite-numberp-tm-svcid, finite-numberp-tm-rwstate, plistp-tm-iports, length-tm-iports, good-tm-iport-array-tm-iports, plistp-tm-oports, length-tm-oports, good-tm-oport-array-tm-oports, good-tm-iport-getnth-from-tm-iports, goodtm-iport-array-putnth-into-tm-iports, good-tm-oport-getnth-from-tm-oports, goodtm-oport-array-putnth-into-tm-oports, finite-numberp-tm-clock, finite-numberp-tm-svmode, finite-numberp-tm-slimit, finite-numberp-tm-limit, finite-numberp-tm-base, finite-number-listp-tm-regs, length-tm-regs, plistp-tm-regs, finite-number-listp-tm-memory, length-tm-memory, plistp-tm-memory, tm-shellp-tm, tm-fix-reg-address-noop, tm-fix-reg-address-size-linear, tm-fix-reg-address-size, numberptm-fix-reg-address, tm-fix-word-noop, tm-fix-word-size-linear, tm-fix-word-size, numberp-tm-fix-word, tm-cc-value-on-compare-lessp, tm-cc-value-on-compare-greaterp, finite-numberp-tm-pack-psw, finite-numberp-tm-overflow-char-tm-wordlub, finite-numberp-tm-ichar-getnth-crock, finite-numberp-tm-interrupting-input-port, finite-numberp-tm-interrupting-input-port-tm-wordlub, good-tm-iport-getnth-properties, finite-numberp-tm-interrupting-output-port, finite-numberp-tm-interrupting-output-port-tm-wordlub, good-tm-oport-getnth-properties.

Event: Let us define the theory tm-definition to consist of the following events: tm-processor, tm-step, tm-post-interrupt, tm-execute-output-interrupt, tm-store-interrupting-output-device, tm-output-interruptp, tm-execute-input-interrupt, tm-store-interrupting-input-device, tm-input-interruptp, tm-overflow-char, tmexecute-svc-interrupt, tm-store-svcid-on-interrupt, tm-svc-interruptp, tm-execute-error-interrupt, tm-errorp, tm-execute-clock-interrupt, tm-clock-interruptp, tmstore-old-psw-on-interrupt, tm-fetch-new-pc-on-interrupt, tm-fetch-execute, tmgood-pc-address, tm-decrement-clock, tm-execute, tm-fetch-arg2, tm-fetch-arg1, tm-fetch-opcode, tm-execute-instruction, tm-execute-binary, tm-execute-unary, tm-execute-nullary, tm-arg2, tm-arg1, tm-datum2, tm-datum1, tm-unary-instructionp, tm-nullary-instructionp, tm-index2, tm-mode2, tm-index1, tm-mode1, tm-opcode, tm-execute-svc-return, tm-execute-svc, tm-execute-start-output, tm-execute-test-iport, tm-execute-test-oport, tm-execute-post-output-interrupt, tm-execute-wait, tm-execute-set-clock, tm-execute-run, tm-execute-return, tm-execute-multiply, tm-execute-move, tm-execute-mod, tm-execute-load-psw, tm-execute-load-limit, tm-execute-load-base, tm-execute-incr-mod, tm-execute-incr, tm-execute-decr-mod, tm-execute-decr, tm-execute-compare, tm-execute-call, tm-execute-branch-not-zero, tm-execute-branch-on-zero, tm-execute-branch, tm-execute-add, tmstack-underflowp, tm-stack-overflowp, tm-store, tm-fetch, tm-store-in-regmem, tm-fetch-from-regmem, tm-store-in-memory, tm-fetch-from-memory, tm-incrn-address, tm-incr-address, tm-good-address, tm-compute-address, tm-arg-index, tm-arg-datum, tm-arg-mode, real-addr-num, real-addr-source, real-addr, tmclear-output-interrupt, tm-post-output-interrupt, tm-start-output, tm-oport-idlep, tm-post-input-interrupt, tm-clear-input-interrupt, tm-iport-errorp, tm-no-svc, tm-svc, tm-waiting, tm-in-supervisor-mode, tm-user-mode, tm-supervisor-mode, tm-pc-address-error, tm-address-error, tm-stack-underflow-error, tm-stack-overflow-error, tm-privilege-error, tm-opcode-error, tm-halt-status, tm-no-error, tm-unpack-svcid, tm-unpack-svcflag, tm-unpack-error, tm-unpack-cc, tm-pack-psw, tmzero-carry-condition, tm-non-zero-carry-condition, tm-zero-no-carry-condition, tm-non-zero-no-carry-condition, tm-set-sp, tm-sp, tm-set-pc, tm-pc, tm-set-oports, tm-set-iports, tm-set-clock, tm-set-rwstate, tm-set-svmode, tm-set-slimit, tmset-limit, tm-set-base, tm-set-svcid, tm-set-svcflag, tm-set-error, tm-set-cc, tmset-regs, tm-set-memory, tm-decr, tm-incrn, tm-incr, tm-r0, tm-r1, tm-r2, tm-r3, tm-r4, tm-r5, tm-r6, tm-r7, tm-shells.

Theorem: finite-numberp-tm-fetch-from-memory-in-supervisor-mode (good-tm (tm) ∧ (tm-in-supervisor-mode (tm) ∧ finite-numberp (n, '65536))) → finite-numberp (tm-fetch-from-memory (n, tm), '65536)

Event: Disable finite-numberp-tm-fetch-from-memory-in-supervisor-mode.

Theorem: finite-numberp-min-difference-memlength-base-limit good-tm (tm) → finite-numberp (min ('65536 − tm-base (tm), tm-limit (tm)), '65536)

Event: Disable finite-numberp-min-difference-memlength-base-limit.

Theorem: lessp-plus-base-addr-memlength (good-tm (tm) ∧ ((real-addr-source (addr) ≄ 0)

∧ ((real-addr-source (addr) ≠ '1)

∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (addr, tm)))))

→ ((tm-base (tm) + real-addr-num (addr)) < '65536)

Event: Disable lessp-plus-base-addr-memlength.

Theorem: finite-numberp-tm-fetch (good-tm (tm) ∧ tm-good-address (addr, tm)) → finite-numberp (tm-fetch (addr, tm), '65536)

Event: Disable finite-numberp-tm-fetch.

(PROVE-LEMMA
 TM-STORE-PRESERVES-ALL-BUT-MEMORY-AND-REGS
 (REWRITE)
 (AND
  (EQUAL (TM-CC (TM-STORE VALUE ADDR TM))
         (TM-CC TM))
  (AND
   (EQUAL (TM-ERROR (TM-STORE VALUE ADDR TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-STORE VALUE ADDR TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-STORE VALUE ADDR TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-STORE VALUE ADDR TM))
             (TM-SLIMIT TM))
      (AND (EQUAL (TM-SVMODE (TM-STORE VALUE ADDR TM))
                  (TM-SVMODE TM))
           (AND (EQUAL (TM-SVCFLAG (TM-STORE VALUE ADDR TM))
                       (TM-SVCFLAG TM))
                (AND (EQUAL (TM-SVCID (TM-STORE VALUE ADDR TM))
                            (TM-SVCID TM))
                     (AND (EQUAL (TM-RWSTATE (TM-STORE VALUE ADDR TM))

                                 (TM-RWSTATE TM))
                          (AND (EQUAL (TM-CLOCK (TM-STORE VALUE ADDR TM))
                                      (TM-CLOCK TM))
                               (AND (EQUAL (TM-IPORTS (TM-STORE VALUE ADDR TM))
                                           (TM-IPORTS TM))
                                    (EQUAL (TM-OPORTS (TM-STORE VALUE ADDR TM))
                                           (TM-OPORTS TM)))))))))))))
 ((ENABLE TM-STORE-IN-MEMORY TM-STORE-IN-REGMEM TM-SET-REGS TM-SET-MEMORY
          TM-STORE)
  (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable tm-store-preserves-all-but-memory-and-regs.

Theorem: tm-good-memory-tm-store (good-tm (tm) ∧ finite-numberp (value, '65536)) → (plistp (tm-memory (tm-store (value, addr, tm)))

∧ ((length (tm-memory (tm-store (value, addr, tm))) = '65536)

∧ finite-number-listp (tm-memory (tm-store (value, addr, tm)),

                             '65536)))

Event: Disable tm-good-memory-tm-store.

Theorem: tm-good-regs-tm-store (good-tm (tm) ∧ finite-numberp (value, '65536)) → (plistp (tm-regs (tm-store (value, addr, tm)))

∧ ((length (tm-regs (tm-store (value, addr, tm))) = '8)

∧ finite-number-listp (tm-regs (tm-store (value, addr, tm)),

                             '65536)))

Event: Disable tm-good-regs-tm-store.

Theorem: good-tm-tm-store (good-tm (tm) ∧ finite-numberp (value, '65536)) → good-tm (tm-store (value, addr, tm))

Event: Disable good-tm-tm-store.

Theorem: good-tm-tm-set-regs (good-tm (tm) ∧ (finite-number-listp (regs, '65536)

∧ (plistp (regs) ∧ (length (regs) = '8)))) → good-tm (tm-set-regs (regs, tm))

Event: Disable good-tm-tm-set-regs.

(PROVE-LEMMA
ACCESS-TM-SET-REGS
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-REGS REGS TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-REGS REGS TM))
         REGS)
  (AND
   (EQUAL (TM-CC (TM-SET-REGS REGS TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-REGS REGS TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-SET-REGS REGS TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-SET-REGS REGS TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-SET-REGS REGS TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-SET-REGS REGS TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-SET-REGS REGS TM))
                (TM-SVCFLAG TM))
         (AND
             (EQUAL (TM-SVCID (TM-SET-REGS REGS TM))
                    (TM-SVCID TM))
             (AND (EQUAL (TM-RWSTATE (TM-SET-REGS REGS TM))
                         (TM-RWSTATE TM))
                  (AND (EQUAL (TM-CLOCK (TM-SET-REGS REGS TM))
                              (TM-CLOCK TM))
                       (AND (EQUAL (TM-IPORTS (TM-SET-REGS REGS TM))
                                   (TM-IPORTS TM))

                            (AND (EQUAL (TM-OPORTS (TM-SET-REGS REGS TM))
                                        (TM-OPORTS TM))
                                 (AND (EQUAL (TM-PC (TM-SET-REGS REGS TM))
                                             (GETNTH '0 REGS))
                                      (EQUAL (TM-SP (TM-SET-REGS REGS TM))
                                             (GETNTH '1 REGS)))))))))))))))))
((ENABLE TM-SET-REGS TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-regs.

Theorem: good-tm-tm-set-memory (good-tm (tm) ∧ (finite-number-listp (memory, '65536)

∧ (plistp (memory) ∧ (length (memory) = '65536)))) → good-tm (tm-set-memory (memory, tm))

Event: Disable good-tm-tm-set-memory.

(PROVE-LEMMA
ACCESS-TM-SET-MEMORY
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-MEMORY MEMORY TM))
        MEMORY)
 (AND
  (EQUAL (TM-REGS (TM-SET-MEMORY MEMORY TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-MEMORY MEMORY TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-MEMORY MEMORY TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-SET-MEMORY MEMORY TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-SET-MEMORY MEMORY TM))
             (TM-LIMIT TM))

      (AND
       (EQUAL (TM-SLIMIT (TM-SET-MEMORY MEMORY TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-SET-MEMORY MEMORY TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-SET-MEMORY MEMORY TM))
                (TM-SVCFLAG TM))
         (AND
             (EQUAL (TM-SVCID (TM-SET-MEMORY MEMORY TM))
                    (TM-SVCID TM))
             (AND (EQUAL (TM-RWSTATE (TM-SET-MEMORY MEMORY TM))
                         (TM-RWSTATE TM))
                  (AND (EQUAL (TM-CLOCK (TM-SET-MEMORY MEMORY TM))
                              (TM-CLOCK TM))
                       (AND (EQUAL (TM-IPORTS (TM-SET-MEMORY MEMORY TM))
                                   (TM-IPORTS TM))
                            (AND (EQUAL (TM-OPORTS (TM-SET-MEMORY MEMORY TM))
                                        (TM-OPORTS TM))
                                 (AND (EQUAL (TM-PC (TM-SET-MEMORY MEMORY TM))
                                             (TM-PC TM))
                                      (EQUAL (TM-SP (TM-SET-MEMORY MEMORY TM))
                                             (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-MEMORY TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-memory.

Theorem: good-tm-tm-set-cc (good-tm (tm) ∧ finite-numberp (cc, '4)) → good-tm (tm-set-cc (cc, tm))

Event: Disable good-tm-tm-set-cc.

(PROVE-LEMMA
ACCESS-TM-SET-CC
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-CC CC TM))
        (TM-MEMORY TM))

(AND
 (EQUAL (TM-REGS (TM-SET-CC CC TM))
        (TM-REGS TM))
 (AND
  (EQUAL (TM-CC (TM-SET-CC CC TM)) CC)
  (AND
   (EQUAL (TM-ERROR (TM-SET-CC CC TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-SET-CC CC TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-SET-CC CC TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-SET-CC CC TM))
             (TM-SLIMIT TM))
      (AND
         (EQUAL (TM-SVMODE (TM-SET-CC CC TM))
                (TM-SVMODE TM))
         (AND (EQUAL (TM-SVCFLAG (TM-SET-CC CC TM))
                     (TM-SVCFLAG TM))
              (AND (EQUAL (TM-SVCID (TM-SET-CC CC TM))
                          (TM-SVCID TM))
                   (AND (EQUAL (TM-RWSTATE (TM-SET-CC CC TM))
                               (TM-RWSTATE TM))
                        (AND (EQUAL (TM-CLOCK (TM-SET-CC CC TM))
                                    (TM-CLOCK TM))
                             (AND (EQUAL (TM-IPORTS (TM-SET-CC CC TM))
                                         (TM-IPORTS TM))
                                  (AND (EQUAL (TM-OPORTS (TM-SET-CC CC TM))
                                              (TM-OPORTS TM))
                                       (AND (EQUAL (TM-PC (TM-SET-CC CC TM))
                                                   (TM-PC TM))
                                            (EQUAL (TM-SP (TM-SET-CC CC TM))
                                                   (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-CC TM-PC TM-SP)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable access-tm-set-cc.

Theorem: good-tm-tm-set-error (good-tm (tm) ∧ finite-numberp (error, '64))

→ good-tm (tm-set-error (error, tm))

Event: Disable good-tm-tm-set-error.

(PROVE-LEMMA
ACCESS-TM-SET-ERROR
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-ERROR ERROR TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-ERROR ERROR TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-ERROR ERROR TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-ERROR ERROR TM))
           ERROR)
    (AND
     (EQUAL (TM-BASE (TM-SET-ERROR ERROR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-SET-ERROR ERROR TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-SET-ERROR ERROR TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-SET-ERROR ERROR TM))
               (TM-SVMODE TM))
        (AND
          (EQUAL (TM-SVCFLAG (TM-SET-ERROR ERROR TM))
                 (TM-SVCFLAG TM))
          (AND (EQUAL (TM-SVCID (TM-SET-ERROR ERROR TM))
                      (TM-SVCID TM))
               (AND (EQUAL (TM-RWSTATE (TM-SET-ERROR ERROR TM))
                           (TM-RWSTATE TM))
                    (AND (EQUAL (TM-CLOCK (TM-SET-ERROR ERROR TM))
                                (TM-CLOCK TM))
                         (AND (EQUAL (TM-IPORTS (TM-SET-ERROR ERROR TM))
                                     (TM-IPORTS TM))

                              (AND (EQUAL (TM-OPORTS (TM-SET-ERROR ERROR TM))
                                          (TM-OPORTS TM))
                                   (AND (EQUAL (TM-PC (TM-SET-ERROR ERROR TM))
                                               (TM-PC TM))
                                        (EQUAL (TM-SP (TM-SET-ERROR ERROR TM))
                                               (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-ERROR TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-error.

Theorem: good-tm-tm-set-base (good-tm (tm) ∧ finite-numberp (base, '65536)) → good-tm (tm-set-base (base, tm))

Event: Disable good-tm-tm-set-base.

(PROVE-LEMMA
ACCESS-TM-SET-BASE
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-BASE BASE TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-BASE BASE TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-BASE BASE TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-BASE BASE TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-SET-BASE BASE TM))
            BASE)
     (AND
      (EQUAL (TM-LIMIT (TM-SET-BASE BASE TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-SET-BASE BASE TM))

              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-SET-BASE BASE TM))
               (TM-SVMODE TM))
        (AND
            (EQUAL (TM-SVCFLAG (TM-SET-BASE BASE TM))
                   (TM-SVCFLAG TM))
            (AND (EQUAL (TM-SVCID (TM-SET-BASE BASE TM))
                        (TM-SVCID TM))
                 (AND (EQUAL (TM-RWSTATE (TM-SET-BASE BASE TM))
                             (TM-RWSTATE TM))
                      (AND (EQUAL (TM-CLOCK (TM-SET-BASE BASE TM))
                                  (TM-CLOCK TM))
                           (AND (EQUAL (TM-IPORTS (TM-SET-BASE BASE TM))
                                       (TM-IPORTS TM))
                                (AND (EQUAL (TM-OPORTS (TM-SET-BASE BASE TM))
                                            (TM-OPORTS TM))
                                     (AND (EQUAL (TM-PC (TM-SET-BASE BASE TM))
                                                 (TM-PC TM))
                                          (EQUAL (TM-SP (TM-SET-BASE BASE TM))
                                                 (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-BASE TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-base.

Theorem: good-tm-tm-set-limit (good-tm (tm) ∧ finite-numberp (limit, '65536)) → good-tm (tm-set-limit (limit, tm))

Event: Disable good-tm-tm-set-limit.

(PROVE-LEMMA
ACCESS-TM-SET-LIMIT
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-LIMIT LIMIT TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-LIMIT LIMIT TM))

(TM-REGS TM))
(AND
(EQUAL (TM-CC (TM-SET-LIMIT LIMIT TM))
(TM-CC TM))
(AND
(EQUAL (TM-ERROR (TM-SET-LIMIT LIMIT TM))
 (TM-ERROR TM))
(AND
(EQUAL (TM-BASE (TM-SET-LIMIT LIMIT TM))
  (TM-BASE TM))
(AND
(EQUAL (TM-LIMIT (TM-SET-LIMIT LIMIT TM))
   LIMIT)
(AND
(EQUAL (TM-SLIMIT (TM-SET-LIMIT LIMIT TM))
    (TM-SLIMIT TM))
(AND
(EQUAL (TM-SVMODE (TM-SET-LIMIT LIMIT TM))
     (TM-SVMODE TM))
(AND
(EQUAL (TM-SVCFLAG (TM-SET-LIMIT LIMIT TM))
       (TM-SVCFLAG TM))
(AND (EQUAL (TM-SVCID (TM-SET-LIMIT LIMIT TM))
            (TM-SVCID TM))
     (AND (EQUAL (TM-RWSTATE (TM-SET-LIMIT LIMIT TM))
                 (TM-RWSTATE TM))
          (AND (EQUAL (TM-CLOCK (TM-SET-LIMIT LIMIT TM))
                      (TM-CLOCK TM))
               (AND (EQUAL (TM-IPORTS (TM-SET-LIMIT LIMIT TM))
                           (TM-IPORTS TM))
                    (AND (EQUAL (TM-OPORTS (TM-SET-LIMIT LIMIT TM))
                                (TM-OPORTS TM))
                         (AND (EQUAL (TM-PC (TM-SET-LIMIT LIMIT TM))
                                     (TM-PC TM))
                              (EQUAL (TM-SP (TM-SET-LIMIT LIMIT TM))
                                     (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-LIMIT TM-PC TM-SP)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable access-tm-set-limit.

Theorem: good-tm-tm-set-slimit (good-tm (tm) ∧ finite-numberp (slimit, '65536))

→ good-tm (tm-set-slimit (slimit, tm))

Event: Disable good-tm-tm-set-slimit.

(PROVE-LEMMA
ACCESS-TM-SET-SLIMIT
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-SLIMIT SLIMIT TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-SLIMIT SLIMIT TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-SLIMIT SLIMIT TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-SLIMIT SLIMIT TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-SET-SLIMIT SLIMIT TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-SET-SLIMIT SLIMIT TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-SET-SLIMIT SLIMIT TM))
              SLIMIT)
       (AND
        (EQUAL (TM-SVMODE (TM-SET-SLIMIT SLIMIT TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-SET-SLIMIT SLIMIT TM))
                (TM-SVCFLAG TM))
         (AND
             (EQUAL (TM-SVCID (TM-SET-SLIMIT SLIMIT TM))
                    (TM-SVCID TM))
             (AND (EQUAL (TM-RWSTATE (TM-SET-SLIMIT SLIMIT TM))
                         (TM-RWSTATE TM))
                  (AND (EQUAL (TM-CLOCK (TM-SET-SLIMIT SLIMIT TM))
                              (TM-CLOCK TM))
                       (AND (EQUAL (TM-IPORTS (TM-SET-SLIMIT SLIMIT TM))

                                   (TM-IPORTS TM))
                            (AND (EQUAL (TM-OPORTS (TM-SET-SLIMIT SLIMIT TM))
                                        (TM-OPORTS TM))
                                 (AND (EQUAL (TM-PC (TM-SET-SLIMIT SLIMIT TM))
                                             (TM-PC TM))
                                      (EQUAL (TM-SP (TM-SET-SLIMIT SLIMIT TM))
                                             (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-SLIMIT TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-slimit.

Theorem: good-tm-tm-set-svmode (good-tm (tm) ∧ finite-numberp (svmode, '2)) → good-tm (tm-set-svmode (svmode, tm))

Event: Disable good-tm-tm-set-svmode.

(PROVE-LEMMA
ACCESS-TM-SET-SVMODE
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-SVMODE SVMODE TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-SVMODE SVMODE TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-SVMODE SVMODE TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-SVMODE SVMODE TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-SET-SVMODE SVMODE TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-SET-SVMODE SVMODE TM))
             (TM-LIMIT TM))
      (AND

       (EQUAL (TM-SLIMIT (TM-SET-SVMODE SVMODE TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-SET-SVMODE SVMODE TM))
               SVMODE)
        (AND
         (EQUAL (TM-SVCFLAG (TM-SET-SVMODE SVMODE TM))
                (TM-SVCFLAG TM))
         (AND
             (EQUAL (TM-SVCID (TM-SET-SVMODE SVMODE TM))
                    (TM-SVCID TM))
             (AND (EQUAL (TM-RWSTATE (TM-SET-SVMODE SVMODE TM))
                         (TM-RWSTATE TM))
                  (AND (EQUAL (TM-CLOCK (TM-SET-SVMODE SVMODE TM))
                              (TM-CLOCK TM))
                       (AND (EQUAL (TM-IPORTS (TM-SET-SVMODE SVMODE TM))
                                   (TM-IPORTS TM))
                            (AND (EQUAL (TM-OPORTS (TM-SET-SVMODE SVMODE TM))
                                        (TM-OPORTS TM))
                                 (AND (EQUAL (TM-PC (TM-SET-SVMODE SVMODE TM))
                                             (TM-PC TM))
                                      (EQUAL (TM-SP (TM-SET-SVMODE SVMODE TM))
                                             (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-SVMODE TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-svmode.

Theorem: good-tm-tm-set-svcflag (good-tm (tm) ∧ finite-numberp (svcflag, '2)) → good-tm (tm-set-svcflag (svcflag, tm))

Event: Disable good-tm-tm-set-svcflag.

(PROVE-LEMMA
ACCESS-TM-SET-SVCFLAG
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-SVCFLAG SVCFLAG TM))
        (TM-MEMORY TM))

(AND
 (EQUAL (TM-REGS (TM-SET-SVCFLAG SVCFLAG TM))
        (TM-REGS TM))
 (AND
  (EQUAL (TM-CC (TM-SET-SVCFLAG SVCFLAG TM))
         (TM-CC TM))
  (AND
   (EQUAL (TM-ERROR (TM-SET-SVCFLAG SVCFLAG TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-SET-SVCFLAG SVCFLAG TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-SET-SVCFLAG SVCFLAG TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-SET-SVCFLAG SVCFLAG TM))
             (TM-SLIMIT TM))
      (AND
       (EQUAL (TM-SVMODE (TM-SET-SVCFLAG SVCFLAG TM))
              (TM-SVMODE TM))
       (AND
        (EQUAL (TM-SVCFLAG (TM-SET-SVCFLAG SVCFLAG TM))
               SVCFLAG)
        (AND
          (EQUAL (TM-SVCID (TM-SET-SVCFLAG SVCFLAG TM))
                 (TM-SVCID TM))
          (AND (EQUAL (TM-RWSTATE (TM-SET-SVCFLAG SVCFLAG TM))
                      (TM-RWSTATE TM))
               (AND (EQUAL (TM-CLOCK (TM-SET-SVCFLAG SVCFLAG TM))
                           (TM-CLOCK TM))
                    (AND (EQUAL (TM-IPORTS (TM-SET-SVCFLAG SVCFLAG TM))
                                (TM-IPORTS TM))
                         (AND (EQUAL (TM-OPORTS (TM-SET-SVCFLAG SVCFLAG TM))
                                     (TM-OPORTS TM))
                              (AND (EQUAL (TM-PC (TM-SET-SVCFLAG SVCFLAG TM))
                                          (TM-PC TM))
                                   (EQUAL (TM-SP (TM-SET-SVCFLAG SVCFLAG TM))
                                          (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-SVCFLAG TM-PC TM-SP)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable access-tm-set-svcflag.

Theorem: good-tm-tm-set-svcid (good-tm (tm) ∧ finite-numberp (svcid, '128)) → good-tm (tm-set-svcid (svcid, tm))

Event: Disable good-tm-tm-set-svcid.

(PROVE-LEMMA
 ACCESS-TM-SET-SVCID
 (REWRITE)
 (AND
  (EQUAL (TM-MEMORY (TM-SET-SVCID SVCID TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-SET-SVCID SVCID TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-SET-SVCID SVCID TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-ERROR (TM-SET-SVCID SVCID TM))
            (TM-ERROR TM))
     (AND
      (EQUAL (TM-BASE (TM-SET-SVCID SVCID TM))
             (TM-BASE TM))
      (AND
       (EQUAL (TM-LIMIT (TM-SET-SVCID SVCID TM))
              (TM-LIMIT TM))
       (AND
        (EQUAL (TM-SLIMIT (TM-SET-SVCID SVCID TM))
               (TM-SLIMIT TM))
        (AND
         (EQUAL (TM-SVMODE (TM-SET-SVCID SVCID TM))
                (TM-SVMODE TM))
         (AND
           (EQUAL (TM-SVCFLAG (TM-SET-SVCID SVCID TM))
                  (TM-SVCFLAG TM))
           (AND (EQUAL (TM-SVCID (TM-SET-SVCID SVCID TM))
                       SVCID)
                (AND (EQUAL (TM-RWSTATE (TM-SET-SVCID SVCID TM))
                            (TM-RWSTATE TM))
                     (AND (EQUAL (TM-CLOCK (TM-SET-SVCID SVCID TM))
                                 (TM-CLOCK TM))

                         (AND (EQUAL (TM-IPORTS (TM-SET-SVCID SVCID TM))
                                     (TM-IPORTS TM))
                              (AND (EQUAL (TM-OPORTS (TM-SET-SVCID SVCID TM))
                                          (TM-OPORTS TM))
                                   (AND (EQUAL (TM-PC (TM-SET-SVCID SVCID TM))
                                               (TM-PC TM))
                                        (EQUAL (TM-SP (TM-SET-SVCID SVCID TM))
                                               (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-SVCID TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-svcid.

Theorem: good-tm-tm-set-rwstate (good-tm (tm) ∧ finite-numberp (rwstate, '2)) → good-tm (tm-set-rwstate (rwstate, tm))

Event: Disable good-tm-tm-set-rwstate.

(PROVE-LEMMA
ACCESS-TM-SET-RWSTATE
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-RWSTATE RWSTATE TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-RWSTATE RWSTATE TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-RWSTATE RWSTATE TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-RWSTATE RWSTATE TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-SET-RWSTATE RWSTATE TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-SET-RWSTATE RWSTATE TM))
             (TM-LIMIT TM))

      (AND
       (EQUAL (TM-SLIMIT (TM-SET-RWSTATE RWSTATE TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-SET-RWSTATE RWSTATE TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-SET-RWSTATE RWSTATE TM))
                (TM-SVCFLAG TM))
         (AND
           (EQUAL (TM-SVCID (TM-SET-RWSTATE RWSTATE TM))
                  (TM-SVCID TM))
           (AND (EQUAL (TM-RWSTATE (TM-SET-RWSTATE RWSTATE TM))
                       RWSTATE)
                (AND (EQUAL (TM-CLOCK (TM-SET-RWSTATE RWSTATE TM))
                            (TM-CLOCK TM))
                     (AND (EQUAL (TM-IPORTS (TM-SET-RWSTATE RWSTATE TM))
                                 (TM-IPORTS TM))
                          (AND (EQUAL (TM-OPORTS (TM-SET-RWSTATE RWSTATE TM))
                                      (TM-OPORTS TM))
                               (AND (EQUAL (TM-PC (TM-SET-RWSTATE RWSTATE TM))
                                           (TM-PC TM))
                                    (EQUAL (TM-SP (TM-SET-RWSTATE RWSTATE TM))
                                           (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-RWSTATE TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-rwstate.

Theorem: good-tm-tm-set-clock (good-tm (tm) ∧ finite-numberp (clock, '65536)) → good-tm (tm-set-clock (clock, tm))

Event: Disable good-tm-tm-set-clock.

(PROVE-LEMMA
ACCESS-TM-SET-CLOCK
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-CLOCK CLOCK TM))

(TM-MEMORY TM))
(AND
(EQUAL (TM-REGS (TM-SET-CLOCK CLOCK TM))
 (TM-REGS TM))
(AND
(EQUAL (TM-CC (TM-SET-CLOCK CLOCK TM))
  (TM-CC TM))
(AND
(EQUAL (TM-ERROR (TM-SET-CLOCK CLOCK TM))
   (TM-ERROR TM))
(AND
(EQUAL (TM-BASE (TM-SET-CLOCK CLOCK TM))
    (TM-BASE TM))
(AND
(EQUAL (TM-LIMIT (TM-SET-CLOCK CLOCK TM))
     (TM-LIMIT TM))
(AND
(EQUAL (TM-SLIMIT (TM-SET-CLOCK CLOCK TM))
      (TM-SLIMIT TM))
(AND
(EQUAL (TM-SVMODE (TM-SET-CLOCK CLOCK TM))
       (TM-SVMODE TM))
(AND
  (EQUAL (TM-SVCFLAG (TM-SET-CLOCK CLOCK TM))
         (TM-SVCFLAG TM))
  (AND (EQUAL (TM-SVCID (TM-SET-CLOCK CLOCK TM))
              (TM-SVCID TM))
       (AND (EQUAL (TM-RWSTATE (TM-SET-CLOCK CLOCK TM))
                   (TM-RWSTATE TM))
            (AND (EQUAL (TM-CLOCK (TM-SET-CLOCK CLOCK TM))
                        CLOCK)
                 (AND (EQUAL (TM-IPORTS (TM-SET-CLOCK CLOCK TM))
                             (TM-IPORTS TM))
                      (AND (EQUAL (TM-OPORTS (TM-SET-CLOCK CLOCK TM))
                                  (TM-OPORTS TM))
                           (AND (EQUAL (TM-PC (TM-SET-CLOCK CLOCK TM))
                                       (TM-PC TM))
                                (EQUAL (TM-SP (TM-SET-CLOCK CLOCK TM))
                                       (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-CLOCK TM-PC TM-SP)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable access-tm-set-clock.

Theorem: good-tm-tm-set-iports (good-tm (tm) ∧ (plistp (iports)

∧ ((length (iports) = '16) ∧ good-tm-iport-array (iports)))) → good-tm (tm-set-iports (iports, tm))

Event: Disable good-tm-tm-set-iports.

(PROVE-LEMMA
 ACCESS-TM-SET-IPORTS
 (REWRITE)
 (AND
  (EQUAL (TM-MEMORY (TM-SET-IPORTS IPORTS TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-SET-IPORTS IPORTS TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-SET-IPORTS IPORTS TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-ERROR (TM-SET-IPORTS IPORTS TM))
            (TM-ERROR TM))
     (AND
      (EQUAL (TM-BASE (TM-SET-IPORTS IPORTS TM))
             (TM-BASE TM))
      (AND
       (EQUAL (TM-LIMIT (TM-SET-IPORTS IPORTS TM))
              (TM-LIMIT TM))
       (AND
        (EQUAL (TM-SLIMIT (TM-SET-IPORTS IPORTS TM))
               (TM-SLIMIT TM))
        (AND
         (EQUAL (TM-SVMODE (TM-SET-IPORTS IPORTS TM))
                (TM-SVMODE TM))
         (AND
          (EQUAL (TM-SVCFLAG (TM-SET-IPORTS IPORTS TM))
                 (TM-SVCFLAG TM))
          (AND
              (EQUAL (TM-SVCID (TM-SET-IPORTS IPORTS TM))
                     (TM-SVCID TM))
              (AND (EQUAL (TM-RWSTATE (TM-SET-IPORTS IPORTS TM))

                         (TM-RWSTATE TM))
                  (AND (EQUAL (TM-CLOCK (TM-SET-IPORTS IPORTS TM))
                              (TM-CLOCK TM))
                       (AND (EQUAL (TM-IPORTS (TM-SET-IPORTS IPORTS TM))
                                   IPORTS)
                            (AND (EQUAL (TM-OPORTS (TM-SET-IPORTS IPORTS TM))
                                        (TM-OPORTS TM))
                                 (AND (EQUAL (TM-PC (TM-SET-IPORTS IPORTS TM))
                                             (TM-PC TM))
                                      (EQUAL (TM-SP (TM-SET-IPORTS IPORTS TM))
                                             (TM-SP TM)))))))))))))))))
((ENABLE TM-SET-IPORTS TM-PC TM-SP)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-iports.

Theorem: good-tm-tm-set-oports (good-tm (tm) ∧ (plistp (oports)

∧ ((length (oports) = '16) ∧ good-tm-oport-array (oports)))) → good-tm (tm-set-oports (oports, tm))

Event: Disable good-tm-tm-set-oports.

(PROVE-LEMMA
ACCESS-TM-SET-OPORTS
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-OPORTS OPORTS TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-SET-OPORTS OPORTS TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-SET-OPORTS OPORTS TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-SET-OPORTS OPORTS TM))
           (TM-ERROR TM))
    (AND

      (EQUAL (TM-BASE (TM-SET-OPORTS OPORTS TM))
             (TM-BASE TM))
      (AND
       (EQUAL (TM-LIMIT (TM-SET-OPORTS OPORTS TM))
              (TM-LIMIT TM))
       (AND
        (EQUAL (TM-SLIMIT (TM-SET-OPORTS OPORTS TM))
               (TM-SLIMIT TM))
        (AND
         (EQUAL (TM-SVMODE (TM-SET-OPORTS OPORTS TM))
                (TM-SVMODE TM))
         (AND
          (EQUAL (TM-SVCFLAG (TM-SET-OPORTS OPORTS TM))
                 (TM-SVCFLAG TM))
          (AND
              (EQUAL (TM-SVCID (TM-SET-OPORTS OPORTS TM))
                     (TM-SVCID TM))
              (AND (EQUAL (TM-RWSTATE (TM-SET-OPORTS OPORTS TM))
                          (TM-RWSTATE TM))
                   (AND (EQUAL (TM-CLOCK (TM-SET-OPORTS OPORTS TM))
                               (TM-CLOCK TM))
                        (AND (EQUAL (TM-IPORTS (TM-SET-OPORTS OPORTS TM))
                                    (TM-IPORTS TM))
                             (AND (EQUAL (TM-OPORTS (TM-SET-OPORTS OPORTS TM))
                                         OPORTS)
                                  (AND (EQUAL (TM-PC (TM-SET-OPORTS OPORTS TM))
                                              (TM-PC TM))
                                       (EQUAL (TM-SP (TM-SET-OPORTS OPORTS TM))
                                              (TM-SP TM)))))))))))))))))
 ((ENABLE TM-SET-OPORTS TM-PC TM-SP)
  (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable access-tm-set-oports.

Theorem: good-tm-tm-set-pc (good-tm (tm) ∧ finite-numberp (pc, '65536)) → good-tm (tm-set-pc (pc, tm))

Event: Disable good-tm-tm-set-pc.

(PROVE-LEMMA

ACCESS-TM-SET-PC
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-PC PC TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-CC (TM-SET-PC PC TM))
         (TM-CC TM))
  (AND
   (EQUAL (TM-ERROR (TM-SET-PC PC TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-SET-PC PC TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-SET-PC PC TM))
            (TM-LIMIT TM))
     (AND
       (EQUAL (TM-SLIMIT (TM-SET-PC PC TM))
              (TM-SLIMIT TM))
       (AND (EQUAL (TM-SVMODE (TM-SET-PC PC TM))
                   (TM-SVMODE TM))
            (AND (EQUAL (TM-SVCFLAG (TM-SET-PC PC TM))
                        (TM-SVCFLAG TM))
                 (AND (EQUAL (TM-SVCID (TM-SET-PC PC TM))
                             (TM-SVCID TM))
                      (AND (EQUAL (TM-RWSTATE (TM-SET-PC PC TM))
                                  (TM-RWSTATE TM))
                           (AND (EQUAL (TM-CLOCK (TM-SET-PC PC TM))
                                       (TM-CLOCK TM))
                                (AND (EQUAL (TM-IPORTS (TM-SET-PC PC TM))
                                            (TM-IPORTS TM))
                                     (AND (EQUAL (TM-OPORTS (TM-SET-PC PC TM))
                                                 (TM-OPORTS TM))
                                          (EQUAL (TM-SP (TM-SET-PC PC TM))
                                                 (TM-SP TM)))))))))))))))
((ENABLE TM-SET-PC TM-PC TM-SP TM-SET-REGS
         A-FINITE-NUMBER-IS-LESSP-THAN-ITS-LUB GETNTH-PUTNTH-NON-INTERFERENCE)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable access-tm-set-pc.

Theorem: good-tm-tm-set-sp (good-tm (tm) ∧ finite-numberp (sp, '65536)) → good-tm (tm-set-sp (sp, tm))

Event: Disable good-tm-tm-set-sp.

(PROVE-LEMMA
ACCESS-TM-SET-SP
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-SET-SP SP TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-CC (TM-SET-SP SP TM))
         (TM-CC TM))
  (AND
   (EQUAL (TM-ERROR (TM-SET-SP SP TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-SET-SP SP TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-SET-SP SP TM))
            (TM-LIMIT TM))
     (AND
       (EQUAL (TM-SLIMIT (TM-SET-SP SP TM))
              (TM-SLIMIT TM))
       (AND (EQUAL (TM-SVMODE (TM-SET-SP SP TM))
                   (TM-SVMODE TM))
            (AND (EQUAL (TM-SVCFLAG (TM-SET-SP SP TM))
                        (TM-SVCFLAG TM))
                 (AND (EQUAL (TM-SVCID (TM-SET-SP SP TM))
                             (TM-SVCID TM))
                      (AND (EQUAL (TM-RWSTATE (TM-SET-SP SP TM))
                                  (TM-RWSTATE TM))
                           (AND (EQUAL (TM-CLOCK (TM-SET-SP SP TM))
                                       (TM-CLOCK TM))
                                (AND (EQUAL (TM-IPORTS (TM-SET-SP SP TM))
                                            (TM-IPORTS TM))
                                     (AND (EQUAL (TM-OPORTS (TM-SET-SP SP TM))
                                                 (TM-OPORTS TM))
                                          (EQUAL (TM-PC (TM-SET-SP SP TM))
                                                 (TM-PC TM)))))))))))))))
((ENABLE TM-SET-SP TM-PC TM-SP TM-SET-REGS

          A-FINITE-NUMBER-IS-LESSP-THAN-ITS-LUB GETNTH-PUTNTH-NON-INTERFERENCE)
  (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable access-tm-set-sp.

Theorem: good-tm-tm-execute-add good-tm (tm) → good-tm (tm-execute-add (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-add.

Theorem: good-tm-tm-execute-branch (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-branch (addr, tm))

Event: Disable good-tm-tm-execute-branch.

Theorem: good-tm-tm-execute-branch-on-zero (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-branch-on-zero (addr, tm))

Event: Disable good-tm-tm-execute-branch-on-zero.

Theorem: good-tm-tm-execute-branch-not-zero (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-branch-not-zero (addr, tm))

Event: Disable good-tm-tm-execute-branch-not-zero.

Theorem: good-tm-tm-execute-call (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-call (addr, tm))

Event: Disable good-tm-tm-execute-call.

Theorem: good-tm-tm-execute-compare good-tm (tm) → good-tm (tm-execute-compare (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-compare.

Theorem: good-tm-tm-execute-decr good-tm (tm) → good-tm (tm-execute-decr (addr, tm))

Event: Disable good-tm-tm-execute-decr.

Theorem: good-tm-tm-execute-decr-mod (good-tm (tm) ∧ (tm-good-address (addr1 , tm) ∧ tm-good-address (addr2 , tm))) → good-tm (tm-execute-decr-mod (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-decr-mod.

Theorem: good-tm-tm-execute-incr good-tm (tm) → good-tm (tm-execute-incr (addr, tm))

Event: Disable good-tm-tm-execute-incr.

Theorem: good-tm-tm-execute-incr-mod (good-tm (tm) ∧ (tm-good-address (addr1 , tm) ∧ tm-good-address (addr2 , tm))) → good-tm (tm-execute-incr-mod (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-incr-mod.

Theorem: good-tm-tm-execute-load-base (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-load-base (addr, tm))

Event: Disable good-tm-tm-execute-load-base.

Theorem: good-tm-tm-execute-load-limit (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-load-limit (addr, tm))

Event: Disable good-tm-tm-execute-load-limit.

Definition: tm-good-supervisor-address (addr) = if real-addr-source (addr) ≃ 0

then finite-numberp (real-addr-num (addr), '65536)

elseif real-addr-source (addr) = '1

then finite-numberp (real-addr-num (addr), '8)

else finite-numberp (real-addr-num (addr), '65536) endif

Theorem: finite-numberp-tm-fetch-in-supervisor-mode (good-tm (tm) ∧ (tm-in-supervisor-mode (tm) ∧ tm-good-supervisor-address (addr))) → finite-numberp (tm-fetch (addr, tm), '65536)

Event: Disable finite-numberp-tm-fetch-in-supervisor-mode.

Theorem: tm-good-supervisor-address-tm-incr-address tm-good-supervisor-address (tm-incr-address (addr))

Event: Disable tm-good-supervisor-address-tm-incr-address.

Theorem: tm-good-supervisor-address-tm-incrn-address tm-good-supervisor-address (addr) → tm-good-supervisor-address (tm-incrn-address (n, addr))

Event: Disable tm-good-supervisor-address-tm-incrn-address.

Theorem: tm-good-supervisor-address-tm-good-address (good-tm (tm) ∧ tm-good-address (addr, tm)) → tm-good-supervisor-address (addr)

Event: Disable tm-good-supervisor-address-tm-good-address.

Theorem: good-tm-tm-execute-load-psw (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-load-psw (addr, tm))

Event: Disable good-tm-tm-execute-load-psw.

Theorem: good-tm-tm-execute-mod good-tm (tm) → good-tm (tm-execute-mod (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-mod.

Theorem: good-tm-tm-execute-move (good-tm (tm) ∧ tm-good-address (addr2 , tm)) → good-tm (tm-execute-move (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-move.

Theorem: good-tm-tm-execute-multiply good-tm (tm) → good-tm (tm-execute-multiply (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-multiply.

Theorem: finite-numberp-add1-tm-sp (good-tm (tm) ∧ (¬ tm-stack-underflowp (tm))) → finite-numberp (1 + tm-sp (tm), '65536)

Event: Disable finite-numberp-add1-tm-sp.

Theorem: tm-incr-sp-is-add1-sp (good-tm (tm) ∧ (¬ tm-stack-underflowp (tm))) → (tm-incr (tm-sp (tm)) = (1 + tm-sp (tm)))

Event: Disable tm-incr-sp-is-add1-sp.

Theorem: good-tm-tm-execute-return good-tm (tm) → good-tm (tm-execute-return (tm))

Event: Disable good-tm-tm-execute-return.

Theorem: good-tm-tm-execute-test-iport good-tm (tm) → good-tm (tm-execute-test-iport (addr, tm))

Event: Disable good-tm-tm-execute-test-iport.

Theorem: good-tm-tm-execute-test-oport good-tm (tm) → good-tm (tm-execute-test-oport (addr, tm))

Event: Disable good-tm-tm-execute-test-oport.

Theorem: good-tm-tm-execute-set-clock (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-set-clock (addr, tm))

Event: Disable good-tm-tm-execute-set-clock.

Theorem: good-tm-tm-execute-run good-tm (tm) → good-tm (tm-execute-run (tm))

Event: Disable good-tm-tm-execute-run.

Theorem: good-tm-tm-execute-wait good-tm (tm) → good-tm (tm-execute-wait (tm))

Event: Disable good-tm-tm-execute-wait.

Theorem: good-tm-oports-tm-post-output-interrupt (plistp (l) ∧ good-tm-oport-array (l)) → (plistp (tm-post-output-interrupt (id, l))

∧ ((length (tm-post-output-interrupt (id, l)) = length (l)) ∧ good-tm-oport-array (tm-post-output-interrupt (id, l))))

Event: Disable good-tm-oports-tm-post-output-interrupt.

Theorem: good-tm-tm-execute-post-output-interrupt good-tm (tm) → good-tm (tm-execute-post-output-interrupt (addr, tm))

Event: Disable good-tm-tm-execute-post-output-interrupt.

Theorem: good-tm-oports-tm-start-output (plistp (l) ∧ good-tm-oport-array (l)) → (plistp (tm-start-output (char, id, l))

∧ ((length (tm-start-output (char, id, l)) = length (l)) ∧ good-tm-oport-array (tm-start-output (char, id, l))))

Event: Disable good-tm-oports-tm-start-output.

Theorem: good-tm-tm-execute-start-output good-tm (tm) → good-tm (tm-execute-start-output (addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-start-output.

Theorem: good-tm-tm-execute-svc (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-svc (addr, tm))

Event: Disable good-tm-tm-execute-svc.

Theorem: good-tm-tm-execute-svc-return (good-tm (tm) ∧ tm-good-address (addr, tm)) → good-tm (tm-execute-svc-return (addr, tm))

Event: Disable good-tm-tm-execute-svc-return.

Theorem: good-tm-tm-execute-nullary good-tm (tm) → good-tm (tm-execute-nullary (opcode, tm))

Event: Disable good-tm-tm-execute-nullary.

Theorem: good-tm-tm-execute-unary good-tm (tm) → good-tm (tm-execute-unary (opcode, addr, tm))

Event: Disable good-tm-tm-execute-unary.

Theorem: good-tm-tm-execute-binary good-tm (tm) → good-tm (tm-execute-binary (opcode, addr1 , addr2 , tm))

Event: Disable good-tm-tm-execute-binary.

Theorem: good-tm-tm-execute-instruction good-tm (tm) → good-tm (tm-execute-instruction (instruction, tm))

Event: Disable good-tm-tm-execute-instruction.

Theorem: plus-tm-base-tm-limit-tm-set-pc (tm-base (tm-set-pc (pc, tm)) + tm-limit (tm-set-pc (pc, tm))) = (tm-base (tm) + tm-limit (tm))

Event: Disable plus-tm-base-tm-limit-tm-set-pc.

Theorem: finite-numberp-tm-good-address (good-tm (tm) ∧ tm-good-address (real-addr ('2, n), tm)) → finite-numberp (n, '65536)

Event: Disable finite-numberp-tm-good-address.

Theorem: good-tm-tm-execute good-tm (tm) → good-tm (tm-execute (instruction, tm))

Event: Disable good-tm-tm-execute.

Theorem: good-tm-tm-decrement-clock good-tm (tm) → good-tm (tm-decrement-clock (tm))

Event: Disable good-tm-tm-decrement-clock.

Theorem: plus-tm-base-tm-limit-tm-decrement-clock (tm-base (tm-decrement-clock (tm)) + tm-limit (tm-decrement-clock (tm))) = (tm-base (tm) + tm-limit (tm))

Event: Disable plus-tm-base-tm-limit-tm-decrement-clock.

(PROVE-LEMMA
TM-DECREMENT-CLOCK-PRESERVES-ALL-BUT-CLOCK
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-DECREMENT-CLOCK TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-DECREMENT-CLOCK TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-DECREMENT-CLOCK TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-DECREMENT-CLOCK TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-DECREMENT-CLOCK TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-DECREMENT-CLOCK TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-DECREMENT-CLOCK TM))
              (TM-SLIMIT TM))
       (AND
          (EQUAL (TM-SVMODE (TM-DECREMENT-CLOCK TM))
                 (TM-SVMODE TM))
          (AND (EQUAL (TM-SVCFLAG (TM-DECREMENT-CLOCK TM))
                      (TM-SVCFLAG TM))
               (AND (EQUAL (TM-SVCID (TM-DECREMENT-CLOCK TM))
                           (TM-SVCID TM))
                    (AND (EQUAL (TM-RWSTATE (TM-DECREMENT-CLOCK TM))
                                (TM-RWSTATE TM))
                         (AND (EQUAL (TM-IPORTS (TM-DECREMENT-CLOCK TM))
                                     (TM-IPORTS TM))
                              (AND (EQUAL (TM-OPORTS (TM-DECREMENT-CLOCK TM))
                                          (TM-OPORTS TM))
                                   (AND (EQUAL (TM-PC (TM-DECREMENT-CLOCK TM))
                                               (TM-PC TM))
                                        (EQUAL (TM-SP (TM-DECREMENT-CLOCK TM))
                                               (TM-SP TM))))))))))))))))
((ENABLE TM-DECREMENT-CLOCK ACCESS-TM-SET-CLOCK)

  (ENABLE-THEORY GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable tm-decrement-clock-preserves-all-but-clock.

Theorem: tm-good-address-tm-decrement-clock tm-good-address (addr, tm-decrement-clock (tm)) = tm-good-address (addr, tm)

Event: Disable tm-good-address-tm-decrement-clock.

Theorem: good-tm-tm-fetch-execute good-tm (tm) → good-tm (tm-fetch-execute (tm))

Event: Disable good-tm-tm-fetch-execute.

Theorem: tm-good-address-tm-store tm-good-address (addr, tm-store (value, addr, tm)) = tm-good-address (addr, tm)

Event: Disable tm-good-address-tm-store.

Theorem: good-tm-tm-execute-clock-interrupt good-tm (tm) → good-tm (tm-execute-clock-interrupt (tm))

Event: Disable good-tm-tm-execute-clock-interrupt.

Theorem: good-tm-tm-execute-error-interrupt good-tm (tm) → good-tm (tm-execute-error-interrupt (tm))

Event: Disable good-tm-tm-execute-error-interrupt.

Theorem: good-tm-tm-execute-svc-interrupt good-tm (tm) → good-tm (tm-execute-svc-interrupt (tm))

Event: Disable good-tm-tm-execute-svc-interrupt.

Theorem: good-tm-tm-execute-input-interrupt (good-tm (tm) ∧ tm-some-input-interruptp (tm-iports (tm))) → good-tm (tm-execute-input-interrupt (tm))

Event: Disable good-tm-tm-execute-input-interrupt.

Theorem: good-tm-tm-execute-output-interrupt (good-tm (tm) ∧ tm-some-output-interruptp (tm-oports (tm))) → good-tm (tm-execute-output-interrupt (tm))

Event: Disable good-tm-tm-execute-output-interrupt.

Theorem: good-tm-tm-step good-tm (tm) → good-tm (tm-step (tm))

Event: Disable good-tm-tm-step.

Theorem: good-tm-iports-tm-post-input-interrupt (plistp (l) ∧ (finite-numberp (id, length (l))

∧ (finite-numberp (char, '256) ∧ good-tm-iport-array (l)))) → (plistp (tm-post-input-interrupt (char, id, l))

∧ ((length (tm-post-input-interrupt (char, id, l)) = length (l)) ∧ good-tm-iport-array (tm-post-input-interrupt (char, id, l))))

Event: Disable good-tm-iports-tm-post-input-interrupt.

Theorem: good-tm-tm-post-interrupt good-tm (tm) → good-tm (tm-post-interrupt (event, tm))

Event: Disable good-tm-tm-post-interrupt.

Theorem: good-tm-tm-processor good-tm (tm) → good-tm (tm-processor (tm, n))

Event: Disable good-tm-tm-processor.

Theorem: registers-untouched-by-tm-execute-add (tm-error (tm-execute-add (addr1 , addr2 , tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-add (addr1 , addr2 , tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-add (addr1 , addr2 , tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-add (addr1 , addr2 , tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-add (addr1 , addr2 , tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-add (addr1 , addr2 , tm))

= tm-svcflag (tm))

∧ ((tm-svcid (tm-execute-add (addr1 , addr2 , tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-add (addr1 , addr2 , tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-add (addr1 , addr2 , tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-add (addr1 , addr2 , tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-add (addr1 , addr2 , tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-add.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-BRANCH
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-EXECUTE-BRANCH ADDR TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-CC (TM-EXECUTE-BRANCH ADDR TM))
         (TM-CC TM))
  (AND
   (EQUAL (TM-ERROR (TM-EXECUTE-BRANCH ADDR TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-EXECUTE-BRANCH ADDR TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-EXECUTE-BRANCH ADDR TM))
            (TM-LIMIT TM))

     (AND
      (EQUAL (TM-SLIMIT (TM-EXECUTE-BRANCH ADDR TM))
             (TM-SLIMIT TM))
      (AND
       (EQUAL (TM-SVMODE (TM-EXECUTE-BRANCH ADDR TM))
              (TM-SVMODE TM))
       (AND
        (EQUAL (TM-SVCFLAG (TM-EXECUTE-BRANCH ADDR TM))
               (TM-SVCFLAG TM))
        (AND
            (EQUAL (TM-SVCID (TM-EXECUTE-BRANCH ADDR TM))
                   (TM-SVCID TM))
            (AND (EQUAL (TM-RWSTATE (TM-EXECUTE-BRANCH ADDR TM))
                        (TM-RWSTATE TM))
                 (AND (EQUAL (TM-CLOCK (TM-EXECUTE-BRANCH ADDR TM))
                             (TM-CLOCK TM))
                      (AND (EQUAL (TM-IPORTS (TM-EXECUTE-BRANCH ADDR TM))
                                  (TM-IPORTS TM))
                           (AND (EQUAL (TM-OPORTS (TM-EXECUTE-BRANCH ADDR TM))
                                       (TM-OPORTS TM))
                                (EQUAL (TM-SP (TM-EXECUTE-BRANCH ADDR TM))
                                       (TM-SP TM)))))))))))))))
((ENABLE TM-EXECUTE-BRANCH ACCESS-TM-SET-PC)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-branch.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-BRANCH-ON-ZERO
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-CC (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
         (TM-CC TM))
  (AND
   (EQUAL (TM-ERROR (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))

           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
             (TM-SLIMIT TM))
      (AND
       (EQUAL (TM-SVMODE (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
              (TM-SVMODE TM))
       (AND
        (EQUAL (TM-SVCFLAG (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
               (TM-SVCFLAG TM))
        (AND
         (EQUAL (TM-SVCID (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
                (TM-SVCID TM))
         (AND
          (EQUAL (TM-RWSTATE (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
                 (TM-RWSTATE TM))
          (AND
              (EQUAL (TM-CLOCK (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
                     (TM-CLOCK TM))
              (AND (EQUAL (TM-IPORTS (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
                          (TM-IPORTS TM))
                   (AND (EQUAL (TM-OPORTS (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
                               (TM-OPORTS TM))
                        (EQUAL (TM-SP (TM-EXECUTE-BRANCH-ON-ZERO ADDR TM))
                               (TM-SP TM)))))))))))))))
((ENABLE TM-EXECUTE-BRANCH-ON-ZERO ACCESS-TM-SET-PC)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-branch-on-zero.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-BRANCH-NOT-ZERO
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-CC (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))

(TM-CC TM))
(AND
(EQUAL (TM-ERROR (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
 (TM-ERROR TM))
(AND
(EQUAL (TM-BASE (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
  (TM-BASE TM))
(AND
(EQUAL (TM-LIMIT (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
   (TM-LIMIT TM))
(AND
(EQUAL (TM-SLIMIT (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
    (TM-SLIMIT TM))
(AND
(EQUAL (TM-SVMODE (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
     (TM-SVMODE TM))
(AND
(EQUAL (TM-SVCFLAG (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
      (TM-SVCFLAG TM))
(AND
(EQUAL (TM-SVCID (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
       (TM-SVCID TM))
(AND
 (EQUAL (TM-RWSTATE (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
        (TM-RWSTATE TM))
 (AND
    (EQUAL (TM-CLOCK (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
           (TM-CLOCK TM))
    (AND (EQUAL (TM-IPORTS (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
                (TM-IPORTS TM))
         (AND (EQUAL (TM-OPORTS (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
                     (TM-OPORTS TM))
              (EQUAL (TM-SP (TM-EXECUTE-BRANCH-NOT-ZERO ADDR TM))
                     (TM-SP TM)))))))))))))))
((ENABLE TM-EXECUTE-BRANCH-NOT-ZERO ACCESS-TM-SET-PC)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-branch-not-zero.

Theorem: registers-untouched-by-tm-execute-call (tm-cc (tm-execute-call (addr, tm)) = tm-cc (tm)) ∧ ((tm-base (tm-execute-call (addr, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-call (addr, tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-call (addr, tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-call (addr, tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-call (addr, tm)) = tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-call (addr,

tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-call (addr,

tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-call (addr,

tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-call (addr,

tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-call (addr,

tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-call.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-COMPARE
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-ERROR (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
          (TM-ERROR TM))
   (AND
    (EQUAL (TM-BASE (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
            (TM-LIMIT TM))

(AND
(EQUAL (TM-SLIMIT (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
(TM-SLIMIT TM))
(AND
(EQUAL (TM-SVMODE (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
 (TM-SVMODE TM))
(AND
(EQUAL (TM-SVCFLAG (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
  (TM-SVCFLAG TM))
(AND
(EQUAL (TM-SVCID (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
   (TM-SVCID TM))
(AND
(EQUAL (TM-RWSTATE (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
    (TM-RWSTATE TM))
(AND
(EQUAL (TM-CLOCK (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
       (TM-CLOCK TM))
(AND (EQUAL (TM-IPORTS (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
            (TM-IPORTS TM))
     (AND (EQUAL (TM-OPORTS (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
                 (TM-OPORTS TM))
          (AND (EQUAL (TM-PC (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
                      (TM-PC TM))
               (EQUAL (TM-SP (TM-EXECUTE-COMPARE ADDR1 ADDR2 TM))
                      (TM-SP TM))))))))))))))))
((ENABLE TM-EXECUTE-COMPARE ACCESS-TM-SET-CC)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-compare.

Theorem: registers-untouched-by-tm-execute-decr (tm-error (tm-execute-decr (addr, tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-decr (addr, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-decr (addr, tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-decr (addr, tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-decr (addr, tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-decr (addr, tm)) = tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-decr (addr,

tm))

= tm-svcid (tm)) ∧ ((tm-rwstate (tm-execute-decr (addr,

tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-decr (addr,

tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-decr (addr,

tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-decr (addr,

tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-decr.

Theorem: registers-untouched-by-tm-execute-decr-mod (tm-error (tm-execute-decr-mod (addr1 , addr2 , tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-decr-mod (addr1 , addr2 , tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-decr-mod (addr1 , addr2 , tm)) = tm-limit (tm)) ∧ ((tm-slimit (tm-execute-decr-mod (addr1 , addr2 , tm))

= tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-decr-mod (addr1 ,

addr2 , tm))

= tm-svmode (tm)) ∧ ((tm-svcflag (tm-execute-decr-mod (addr1 ,

addr2 , tm))

= tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-decr-mod (addr1 ,

addr2 , tm))

= tm-svcid (tm)) ∧ ((tm-rwstate (tm-execute-decr-mod (addr1 ,

addr2 , tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-decr-mod (addr1 , addr2 , tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-decr-mod (addr1 , addr2 , tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-decr-mod (addr1 , addr2 , tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-decr-mod.

Theorem: registers-untouched-by-tm-execute-incr (tm-error (tm-execute-incr (addr, tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-incr (addr, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-incr (addr, tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-incr (addr, tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-incr (addr, tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-incr (addr, tm)) = tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-incr (addr,

tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-incr (addr,

tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-incr (addr,

tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-incr (addr,

tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-incr (addr,

tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-incr.

Theorem: registers-untouched-by-tm-execute-incr-mod (tm-error (tm-execute-incr-mod (addr1 , addr2 , tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-incr-mod (addr1 , addr2 , tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-incr-mod (addr1 , addr2 , tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-incr-mod (addr1 , addr2 , tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-incr-mod (addr1 ,

addr2 , tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-incr-mod (addr1 , addr2 , tm))

= tm-svcflag (tm))

∧ ((tm-svcid (tm-execute-incr-mod (addr1 , addr2 , tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-incr-mod (addr1 , addr2 , tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-incr-mod (addr1 , addr2 , tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-incr-mod (addr1 , addr2 , tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-incr-mod (addr1 , addr2 , tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-incr-mod.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-LOAD-BASE
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-LOAD-BASE ADDR TM))
         (TM-MEMORY TM))
  (AND

(EQUAL (TM-REGS (TM-EXECUTE-LOAD-BASE ADDR TM))
(TM-REGS TM))
(AND
(EQUAL (TM-CC (TM-EXECUTE-LOAD-BASE ADDR TM))
 (TM-CC TM))
(AND
(EQUAL (TM-BASE (TM-EXECUTE-LOAD-BASE ADDR TM))
  (TM-BASE TM))
(AND
(EQUAL (TM-LIMIT (TM-EXECUTE-LOAD-BASE ADDR TM))
   (TM-LIMIT TM))
(AND
(EQUAL (TM-SLIMIT (TM-EXECUTE-LOAD-BASE ADDR TM))
    (TM-SLIMIT TM))
(AND
(EQUAL (TM-SVMODE (TM-EXECUTE-LOAD-BASE ADDR TM))
     (TM-SVMODE TM))
(AND
(EQUAL (TM-SVCFLAG (TM-EXECUTE-LOAD-BASE ADDR TM))
      (TM-SVCFLAG TM))
(AND
(EQUAL (TM-SVCID (TM-EXECUTE-LOAD-BASE ADDR TM))
       (TM-SVCID TM))
(AND
   (EQUAL (TM-RWSTATE (TM-EXECUTE-LOAD-BASE ADDR TM))
          (TM-RWSTATE TM))
   (AND (EQUAL (TM-CLOCK (TM-EXECUTE-LOAD-BASE ADDR TM))
               (TM-CLOCK TM))
        (AND (EQUAL (TM-IPORTS (TM-EXECUTE-LOAD-BASE ADDR TM))
                    (TM-IPORTS TM))
             (AND (EQUAL (TM-OPORTS (TM-EXECUTE-LOAD-BASE ADDR TM))
                         (TM-OPORTS TM))
                  (AND (EQUAL (TM-PC (TM-EXECUTE-LOAD-BASE ADDR TM))
                              (TM-PC TM))
                       (EQUAL (TM-SP (TM-EXECUTE-LOAD-BASE ADDR TM))
                              (TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-LOAD-BASE ACCESS-TM-SET-ERROR)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-load-base.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-LOAD-LIMIT
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-LOAD-LIMIT ADDR TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-EXECUTE-LOAD-LIMIT ADDR TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-EXECUTE-LOAD-LIMIT ADDR TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-LOAD-LIMIT ADDR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-LOAD-LIMIT ADDR TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-EXECUTE-LOAD-LIMIT ADDR TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-LOAD-LIMIT ADDR TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                (TM-SVCFLAG TM))
         (AND
          (EQUAL (TM-SVCID (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                 (TM-SVCID TM))
          (AND
            (EQUAL (TM-RWSTATE (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                   (TM-RWSTATE TM))
            (AND (EQUAL (TM-CLOCK (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                        (TM-CLOCK TM))
                 (AND (EQUAL (TM-IPORTS (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                             (TM-IPORTS TM))
                      (AND (EQUAL (TM-OPORTS (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                                  (TM-OPORTS TM))
                           (AND (EQUAL (TM-PC (TM-EXECUTE-LOAD-LIMIT ADDR TM))
                                       (TM-PC TM))
                                (EQUAL (TM-SP (TM-EXECUTE-LOAD-LIMIT ADDR TM))

                                       (TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-LOAD-LIMIT ACCESS-TM-SET-ERROR)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-load-limit.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-LOAD-PSW
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-LOAD-PSW ADDR TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-EXECUTE-LOAD-PSW ADDR TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-EXECUTE-LOAD-PSW ADDR TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-LOAD-PSW ADDR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-LOAD-PSW ADDR TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-EXECUTE-LOAD-PSW ADDR TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-LOAD-PSW ADDR TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-EXECUTE-LOAD-PSW ADDR TM))
                (TM-SVCFLAG TM))
         (AND
          (EQUAL (TM-SVCID (TM-EXECUTE-LOAD-PSW ADDR TM))
                 (TM-SVCID TM))
          (AND
              (EQUAL (TM-RWSTATE (TM-EXECUTE-LOAD-PSW ADDR TM))
                     (TM-RWSTATE TM))

(AND (EQUAL (TM-CLOCK (TM-EXECUTE-LOAD-PSW ADDR TM))
(TM-CLOCK TM))
(AND (EQUAL (TM-IPORTS (TM-EXECUTE-LOAD-PSW ADDR TM))
(TM-IPORTS TM))
(AND (EQUAL (TM-OPORTS (TM-EXECUTE-LOAD-PSW ADDR TM))
(TM-OPORTS TM))
(AND (EQUAL (TM-PC (TM-EXECUTE-LOAD-PSW ADDR TM))
(TM-PC TM))
(EQUAL (TM-SP (TM-EXECUTE-LOAD-PSW ADDR TM))
(TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-LOAD-PSW ACCESS-TM-SET-ERROR)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-load-psw.

Theorem: registers-untouched-by-tm-execute-mod (tm-error (tm-execute-mod (addr1 , addr2 , tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-mod (addr1 , addr2 , tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-mod (addr1 , addr2 , tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-mod (addr1 , addr2 , tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-mod (addr1 , addr2 , tm))

= tm-svmode (tm)) ∧ ((tm-svcflag (tm-execute-mod (addr1 ,

addr2 , tm))

= tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-mod (addr1 ,

addr2 , tm))

= tm-svcid (tm)) ∧ ((tm-rwstate (tm-execute-mod (addr1 ,

addr2 , tm))

= tm-rwstate (tm)) ∧ ((tm-clock (tm-execute-mod (addr1 ,

addr2 , tm))

= tm-clock (tm)) ∧ ((tm-iports (tm-execute-mod (addr1 ,

addr2 , tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-mod (addr1 , addr2 , tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-mod.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-MOVE
(REWRITE)
(AND
 (EQUAL (TM-CC (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
        (TM-CC TM))
 (AND
  (EQUAL (TM-ERROR (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
         (TM-ERROR TM))
  (AND
   (EQUAL (TM-BASE (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
          (TM-BASE TM))
   (AND
    (EQUAL (TM-LIMIT (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
           (TM-LIMIT TM))
    (AND
     (EQUAL (TM-SLIMIT (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
            (TM-SLIMIT TM))
     (AND
      (EQUAL (TM-SVMODE (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
             (TM-SVMODE TM))
      (AND
       (EQUAL (TM-SVCFLAG (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
              (TM-SVCFLAG TM))
       (AND (EQUAL (TM-SVCID (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
                   (TM-SVCID TM))
            (AND (EQUAL (TM-RWSTATE (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
                        (TM-RWSTATE TM))
                 (AND (EQUAL (TM-CLOCK (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
                             (TM-CLOCK TM))
                      (AND (EQUAL (TM-IPORTS (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
                                  (TM-IPORTS TM))
                           (EQUAL (TM-OPORTS (TM-EXECUTE-MOVE ADDR1 ADDR2 TM))
                                  (TM-OPORTS TM)))))))))))))
((ENABLE TM-EXECUTE-MOVE TM-STORE-PRESERVES-ALL-BUT-MEMORY-AND-REGS)

  (ENABLE-THEORY GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-move.

Theorem: registers-untouched-by-tm-execute-multiply (tm-error (tm-execute-multiply (addr1 , addr2 , tm)) = tm-error (tm)) ∧ ((tm-base (tm-execute-multiply (addr1 , addr2 , tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-multiply (addr1 , addr2 , tm)) = tm-limit (tm)) ∧ ((tm-slimit (tm-execute-multiply (addr1 , addr2 , tm))

= tm-slimit (tm))

∧ ((tm-svmode (tm-execute-multiply (addr1 , addr2 , tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-multiply (addr1 , addr2 , tm))

= tm-svcflag (tm))

∧ ((tm-svcid (tm-execute-multiply (addr1 , addr2 , tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-multiply (addr1 , addr2 , tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-multiply (addr1 , addr2 , tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-multiply (addr1 , addr2 , tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-multiply (addr1 , addr2 , tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-multiply.

Theorem: registers-untouched-by-tm-execute-return (tm-memory (tm-execute-return (tm)) = tm-memory (tm)) ∧ ((tm-cc (tm-execute-return (tm)) = tm-cc (tm))

∧ ((tm-base (tm-execute-return (tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-return (tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-return (tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-return (tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-return (tm)) = tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-return (tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-return (tm)) = tm-rwstate (tm)) ∧ ((tm-clock (tm-execute-return (tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-return (tm)) = tm-iports (tm)) ∧ (tm-oports (tm-execute-return (tm)) = tm-oports (tm))))))))))))

Event: Disable registers-untouched-by-tm-execute-return.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-SET-CLOCK
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-SET-CLOCK ADDR TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-EXECUTE-SET-CLOCK ADDR TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-EXECUTE-SET-CLOCK ADDR TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-SET-CLOCK ADDR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-SET-CLOCK ADDR TM))

             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-EXECUTE-SET-CLOCK ADDR TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-SET-CLOCK ADDR TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-EXECUTE-SET-CLOCK ADDR TM))
                (TM-SVCFLAG TM))
         (AND
          (EQUAL (TM-SVCID (TM-EXECUTE-SET-CLOCK ADDR TM))
                 (TM-SVCID TM))
          (AND
             (EQUAL (TM-RWSTATE (TM-EXECUTE-SET-CLOCK ADDR TM))
                    (TM-RWSTATE TM))
             (AND (EQUAL (TM-CLOCK (TM-EXECUTE-SET-CLOCK ADDR TM))
                         (TM-CLOCK TM))
                  (AND (EQUAL (TM-IPORTS (TM-EXECUTE-SET-CLOCK ADDR TM))
                              (TM-IPORTS TM))
                       (AND (EQUAL (TM-OPORTS (TM-EXECUTE-SET-CLOCK ADDR TM))
                                   (TM-OPORTS TM))
                            (AND (EQUAL (TM-PC (TM-EXECUTE-SET-CLOCK ADDR TM))
                                        (TM-PC TM))
                                 (EQUAL (TM-SP (TM-EXECUTE-SET-CLOCK ADDR TM))
                                        (TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-SET-CLOCK ACCESS-TM-SET-ERROR)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-set-clock.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-RUN
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-RUN TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-CC (TM-EXECUTE-RUN TM))

          (TM-CC TM))
   (AND
    (EQUAL (TM-BASE (TM-EXECUTE-RUN TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-EXECUTE-RUN TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-EXECUTE-RUN TM))
             (TM-SLIMIT TM))
      (AND
         (EQUAL (TM-SVMODE (TM-EXECUTE-RUN TM))
                (TM-SVMODE TM))
         (AND (EQUAL (TM-SVCFLAG (TM-EXECUTE-RUN TM))
                     (TM-SVCFLAG TM))
              (AND (EQUAL (TM-SVCID (TM-EXECUTE-RUN TM))
                          (TM-SVCID TM))
                   (AND (EQUAL (TM-RWSTATE (TM-EXECUTE-RUN TM))
                               (TM-RWSTATE TM))
                        (AND (EQUAL (TM-CLOCK (TM-EXECUTE-RUN TM))
                                    (TM-CLOCK TM))
                             (AND (EQUAL (TM-IPORTS (TM-EXECUTE-RUN TM))
                                         (TM-IPORTS TM))
                                  (AND (EQUAL (TM-OPORTS (TM-EXECUTE-RUN TM))
                                              (TM-OPORTS TM))
                                       (AND (EQUAL (TM-PC (TM-EXECUTE-RUN TM))
                                                   (TM-PC TM))
                                            (EQUAL (TM-SP (TM-EXECUTE-RUN TM))
                                                   (TM-SP TM))))))))))))))))
((ENABLE TM-EXECUTE-RUN ACCESS-TM-SET-ERROR)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-run.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-WAIT
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-WAIT TM))

         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-CC (TM-EXECUTE-WAIT TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-BASE (TM-EXECUTE-WAIT TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-EXECUTE-WAIT TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-EXECUTE-WAIT TM))
             (TM-SLIMIT TM))
      (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-WAIT TM))
               (TM-SVMODE TM))
        (AND (EQUAL (TM-SVCFLAG (TM-EXECUTE-WAIT TM))
                    (TM-SVCFLAG TM))
             (AND (EQUAL (TM-SVCID (TM-EXECUTE-WAIT TM))
                         (TM-SVCID TM))
                  (AND (EQUAL (TM-RWSTATE (TM-EXECUTE-WAIT TM))
                              (TM-RWSTATE TM))
                       (AND (EQUAL (TM-CLOCK (TM-EXECUTE-WAIT TM))
                                   (TM-CLOCK TM))
                            (AND (EQUAL (TM-IPORTS (TM-EXECUTE-WAIT TM))
                                        (TM-IPORTS TM))
                                 (AND (EQUAL (TM-OPORTS (TM-EXECUTE-WAIT TM))
                                             (TM-OPORTS TM))
                                      (AND (EQUAL (TM-PC (TM-EXECUTE-WAIT TM))
                                                  (TM-PC TM))
                                           (EQUAL (TM-SP (TM-EXECUTE-WAIT TM))
                                                  (TM-SP TM))))))))))))))))
((ENABLE TM-EXECUTE-WAIT ACCESS-TM-SET-ERROR)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-wait.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-TEST-IPORT
(REWRITE)
(IMPLIES

(NOT (TM-IN-SUPERVISOR-MODE TM))
(AND
 (EQUAL (TM-MEMORY (TM-EXECUTE-TEST-IPORT ADDR TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-EXECUTE-TEST-IPORT ADDR TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-EXECUTE-TEST-IPORT ADDR TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-BASE (TM-EXECUTE-TEST-IPORT ADDR TM))
           (TM-BASE TM))
    (AND
     (EQUAL (TM-LIMIT (TM-EXECUTE-TEST-IPORT ADDR TM))
            (TM-LIMIT TM))
     (AND
      (EQUAL (TM-SLIMIT (TM-EXECUTE-TEST-IPORT ADDR TM))
             (TM-SLIMIT TM))
      (AND
       (EQUAL (TM-SVMODE (TM-EXECUTE-TEST-IPORT ADDR TM))
              (TM-SVMODE TM))
       (AND
        (EQUAL (TM-SVCFLAG (TM-EXECUTE-TEST-IPORT ADDR TM))
               (TM-SVCFLAG TM))
        (AND
         (EQUAL (TM-SVCID (TM-EXECUTE-TEST-IPORT ADDR TM))
                (TM-SVCID TM))
         (AND
           (EQUAL (TM-RWSTATE (TM-EXECUTE-TEST-IPORT ADDR TM))
                  (TM-RWSTATE TM))
           (AND (EQUAL (TM-CLOCK (TM-EXECUTE-TEST-IPORT ADDR TM))
                       (TM-CLOCK TM))
                (AND (EQUAL (TM-IPORTS (TM-EXECUTE-TEST-IPORT ADDR TM))
                            (TM-IPORTS TM))
                     (AND (EQUAL (TM-OPORTS (TM-EXECUTE-TEST-IPORT ADDR TM))
                                 (TM-OPORTS TM))
                          (AND (EQUAL (TM-PC (TM-EXECUTE-TEST-IPORT ADDR TM))
                                      (TM-PC TM))
                               (EQUAL (TM-SP (TM-EXECUTE-TEST-IPORT ADDR TM))
                                      (TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-TEST-IPORT ACCESS-TM-SET-ERROR)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-test-iport.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-TEST-OPORT
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-TEST-OPORT ADDR TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-EXECUTE-TEST-OPORT ADDR TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-EXECUTE-TEST-OPORT ADDR TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-TEST-OPORT ADDR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-TEST-OPORT ADDR TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-EXECUTE-TEST-OPORT ADDR TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-TEST-OPORT ADDR TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-EXECUTE-TEST-OPORT ADDR TM))
                (TM-SVCFLAG TM))
         (AND
          (EQUAL (TM-SVCID (TM-EXECUTE-TEST-OPORT ADDR TM))
                 (TM-SVCID TM))
          (AND
            (EQUAL (TM-RWSTATE (TM-EXECUTE-TEST-OPORT ADDR TM))
                   (TM-RWSTATE TM))
            (AND (EQUAL (TM-CLOCK (TM-EXECUTE-TEST-OPORT ADDR TM))
                        (TM-CLOCK TM))
                 (AND (EQUAL (TM-IPORTS (TM-EXECUTE-TEST-OPORT ADDR TM))
                             (TM-IPORTS TM))

                      (AND (EQUAL (TM-OPORTS (TM-EXECUTE-TEST-OPORT ADDR TM))
                                  (TM-OPORTS TM))
                           (AND (EQUAL (TM-PC (TM-EXECUTE-TEST-OPORT ADDR TM))
                                       (TM-PC TM))
                                (EQUAL (TM-SP (TM-EXECUTE-TEST-OPORT ADDR TM))
                                       (TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-TEST-OPORT ACCESS-TM-SET-ERROR)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-test-oport.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-START-OUTPUT
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
                (TM-SVCFLAG TM))
         (AND

(EQUAL (TM-SVCID (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
(TM-SVCID TM))
(AND
(EQUAL (TM-RWSTATE (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
(TM-RWSTATE TM))
(AND (EQUAL (TM-CLOCK (TM-EXECUTE-START-OUTPUT ADDR1 ADDR2 TM))
(TM-CLOCK TM))
(AND (EQUAL (TM-IPORTS (TM-EXECUTE-START-OUTPUT ADDR1
ADDR2 TM))
(TM-IPORTS TM))
(AND (EQUAL (TM-OPORTS (TM-EXECUTE-START-OUTPUT ADDR1
ADDR2
TM))
(TM-OPORTS TM))
(AND (EQUAL (TM-PC (TM-EXECUTE-START-OUTPUT ADDR1
ADDR2
TM))
(TM-PC TM))
(EQUAL (TM-SP (TM-EXECUTE-START-OUTPUT ADDR1
ADDR2
TM))
(TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-START-OUTPUT ACCESS-TM-SET-ERROR)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-start-output.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-POST-OUTPUT-INTERRUPT
(REWRITE)
(IMPLIES
(NOT (TM-IN-SUPERVISOR-MODE TM))
(AND
(EQUAL (TM-MEMORY (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
(TM-MEMORY TM))
(AND
(EQUAL (TM-REGS (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
(TM-REGS TM))
(AND
(EQUAL (TM-CC (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
(TM-CC TM))

(AND
(EQUAL (TM-BASE (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
(TM-BASE TM))
(AND
(EQUAL (TM-LIMIT (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
 (TM-LIMIT TM))
(AND
(EQUAL (TM-SLIMIT (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
  (TM-SLIMIT TM))
(AND
(EQUAL (TM-SVMODE (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
   (TM-SVMODE TM))
(AND
(EQUAL (TM-SVCFLAG (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
    (TM-SVCFLAG TM))
(AND
(EQUAL (TM-SVCID (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
     (TM-SVCID TM))
(AND
(EQUAL (TM-RWSTATE (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
      (TM-RWSTATE TM))
(AND
(EQUAL (TM-CLOCK (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
       (TM-CLOCK TM))
(AND
    (EQUAL (TM-IPORTS (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR TM))
           (TM-IPORTS TM))
    (AND (EQUAL (TM-OPORTS (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR
                                                             TM))
                (TM-OPORTS TM))
         (AND (EQUAL (TM-PC (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR
                                                              TM))
                     (TM-PC TM))
              (EQUAL (TM-SP (TM-EXECUTE-POST-OUTPUT-INTERRUPT ADDR
                                                              TM))
                     (TM-SP TM)))))))))))))))))
((ENABLE TM-EXECUTE-POST-OUTPUT-INTERRUPT ACCESS-TM-SET-ERROR)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-post-output-interrupt.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-SVC
(REWRITE)
(AND
 (EQUAL (TM-MEMORY (TM-EXECUTE-SVC ADDR TM))
        (TM-MEMORY TM))
 (AND
  (EQUAL (TM-REGS (TM-EXECUTE-SVC ADDR TM))
         (TM-REGS TM))
  (AND
   (EQUAL (TM-CC (TM-EXECUTE-SVC ADDR TM))
          (TM-CC TM))
   (AND
    (EQUAL (TM-ERROR (TM-EXECUTE-SVC ADDR TM))
           (TM-ERROR TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-SVC ADDR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-SVC ADDR TM))
             (TM-LIMIT TM))
      (AND
         (EQUAL (TM-SLIMIT (TM-EXECUTE-SVC ADDR TM))
                (TM-SLIMIT TM))
         (AND (EQUAL (TM-SVMODE (TM-EXECUTE-SVC ADDR TM))
                     (TM-SVMODE TM))
              (AND (EQUAL (TM-RWSTATE (TM-EXECUTE-SVC ADDR TM))
                          (TM-RWSTATE TM))
                   (AND (EQUAL (TM-CLOCK (TM-EXECUTE-SVC ADDR TM))
                               (TM-CLOCK TM))
                        (AND (EQUAL (TM-IPORTS (TM-EXECUTE-SVC ADDR TM))
                                    (TM-IPORTS TM))
                             (AND (EQUAL (TM-OPORTS (TM-EXECUTE-SVC ADDR TM))
                                         (TM-OPORTS TM))
                                  (AND (EQUAL (TM-PC (TM-EXECUTE-SVC ADDR TM))
                                              (TM-PC TM))
                                       (EQUAL (TM-SP (TM-EXECUTE-SVC ADDR TM))
                                              (TM-SP TM)))))))))))))))
((ENABLE TM-EXECUTE-SVC ACCESS-TM-SET-SVCID ACCESS-TM-SET-SVCFLAG)
 (ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-svc.

(PROVE-LEMMA
REGISTERS-UNTOUCHED-BY-TM-EXECUTE-SVC-RETURN
(REWRITE)
(IMPLIES
 (NOT (TM-IN-SUPERVISOR-MODE TM))
 (AND
  (EQUAL (TM-MEMORY (TM-EXECUTE-SVC-RETURN ADDR TM))
         (TM-MEMORY TM))
  (AND
   (EQUAL (TM-REGS (TM-EXECUTE-SVC-RETURN ADDR TM))
          (TM-REGS TM))
   (AND
    (EQUAL (TM-CC (TM-EXECUTE-SVC-RETURN ADDR TM))
           (TM-CC TM))
    (AND
     (EQUAL (TM-BASE (TM-EXECUTE-SVC-RETURN ADDR TM))
            (TM-BASE TM))
     (AND
      (EQUAL (TM-LIMIT (TM-EXECUTE-SVC-RETURN ADDR TM))
             (TM-LIMIT TM))
      (AND
       (EQUAL (TM-SLIMIT (TM-EXECUTE-SVC-RETURN ADDR TM))
              (TM-SLIMIT TM))
       (AND
        (EQUAL (TM-SVMODE (TM-EXECUTE-SVC-RETURN ADDR TM))
               (TM-SVMODE TM))
        (AND
         (EQUAL (TM-SVCFLAG (TM-EXECUTE-SVC-RETURN ADDR TM))
                (TM-SVCFLAG TM))
         (AND
          (EQUAL (TM-SVCID (TM-EXECUTE-SVC-RETURN ADDR TM))
                 (TM-SVCID TM))
          (AND
            (EQUAL (TM-RWSTATE (TM-EXECUTE-SVC-RETURN ADDR TM))
                   (TM-RWSTATE TM))
            (AND (EQUAL (TM-CLOCK (TM-EXECUTE-SVC-RETURN ADDR TM))
                        (TM-CLOCK TM))
                 (AND (EQUAL (TM-IPORTS (TM-EXECUTE-SVC-RETURN ADDR TM))
                             (TM-IPORTS TM))
                      (AND (EQUAL (TM-OPORTS (TM-EXECUTE-SVC-RETURN ADDR TM))
                                  (TM-OPORTS TM))
                           (AND (EQUAL (TM-PC (TM-EXECUTE-SVC-RETURN ADDR TM))

                                        (TM-PC TM))
                                 (EQUAL (TM-SP (TM-EXECUTE-SVC-RETURN ADDR TM))
                                        (TM-SP TM)))))))))))))))))
 ((ENABLE TM-EXECUTE-SVC-RETURN ACCESS-TM-SET-ERROR)
  (ENABLE-THEORY GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable registers-untouched-by-tm-execute-svc-return.

Theorem: registers-untouched-by-tm-execute-nullary (¬ tm-in-supervisor-mode (tm)) → ((tm-base (tm-execute-nullary (opcode, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-nullary (opcode, tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute-nullary (opcode, tm)) = tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-nullary (opcode, tm))

= tm-svmode (tm))

∧ ((tm-svcflag (tm-execute-nullary (opcode,

tm))

= tm-svcflag (tm))

∧ ((tm-svcid (tm-execute-nullary (opcode,

tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-nullary (opcode,

tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute-nullary (opcode,

tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute-nullary (opcode,

tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute-nullary (opcode,

tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-nullary.

Theorem: registers-untouched-by-tm-execute-unary (¬ tm-in-supervisor-mode (tm)) → ((tm-base (tm-execute-unary (opcode, addr, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-unary (opcode, addr, tm)) = tm-limit (tm)) ∧ ((tm-slimit (tm-execute-unary (opcode, addr, tm))

= tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-unary (opcode, addr, tm))

= tm-svmode (tm)) ∧ ((tm-rwstate (tm-execute-unary (opcode,

addr, tm))

= tm-rwstate (tm)) ∧ ((tm-clock (tm-execute-unary (opcode,

addr, tm))

= tm-clock (tm)) ∧ ((tm-iports (tm-execute-unary (opcode,

addr, tm))

= tm-iports (tm)) ∧ (tm-oports (tm-execute-unary (opcode,

addr, tm))

= tm-oports (tm)))))))))

Event: Disable registers-untouched-by-tm-execute-unary.

Theorem: registers-untouched-by-tm-execute-binary (¬ tm-in-supervisor-mode (tm)) → ((tm-base (tm-execute-binary (opcode, addr1 , addr2 , tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-binary (opcode, addr1 , addr2 , tm)) = tm-limit (tm)) ∧ ((tm-slimit (tm-execute-binary (opcode, addr1 , addr2 , tm))

= tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-binary (opcode,

addr1 , addr2 , tm))

= tm-svmode (tm)) ∧ ((tm-svcflag (tm-execute-binary (opcode,

addr1 , addr2 , tm))

= tm-svcflag (tm)) ∧ ((tm-svcid (tm-execute-binary (opcode,

addr1 , addr2 , tm))

= tm-svcid (tm))

∧ ((tm-rwstate (tm-execute-binary (opcode, addr1 , addr2 , tm))

= tm-rwstate (tm)) ∧ ((tm-clock (tm-execute-binary (opcode,

addr1 , addr2 , tm))

= tm-clock (tm)) ∧ ((tm-iports (tm-execute-binary (opcode,

addr1 , addr2 , tm))

= tm-iports (tm)) ∧ (tm-oports (tm-execute-binary (opcode,

addr1 , addr2 , tm))

= tm-oports (tm)))))))))))

Event: Disable registers-untouched-by-tm-execute-binary.

Theorem: registers-untouched-by-tm-execute-instruction (¬ tm-in-supervisor-mode (tm)) → ((tm-base (tm-execute-instruction (instruction, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute-instruction (instruction, tm)) = tm-limit (tm)) ∧ ((tm-slimit (tm-execute-instruction (instruction, tm))

= tm-slimit (tm)) ∧ ((tm-svmode (tm-execute-instruction (instruction,

tm))

= tm-svmode (tm)) ∧ ((tm-rwstate (tm-execute-instruction (instruction,

tm))

= tm-rwstate (tm)) ∧ ((tm-clock (tm-execute-instruction (instruction,

tm))

= tm-clock (tm)) ∧ ((tm-iports (tm-execute-instruction (instruction,

tm))

= tm-iports (tm)) ∧ (tm-oports (tm-execute-instruction (instruction,

tm))

= tm-oports (tm)))))))))

Event: Disable registers-untouched-by-tm-execute-instruction.

Theorem: registers-untouched-by-tm-execute (¬ tm-in-supervisor-mode (tm)) → ((tm-base (tm-execute (opcode, tm)) = tm-base (tm))

∧ ((tm-limit (tm-execute (opcode, tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-execute (opcode, tm)) = tm-slimit (tm))

∧ ((tm-svmode (tm-execute (opcode, tm)) = tm-svmode (tm)) ∧ ((tm-rwstate (tm-execute (opcode, tm))

= tm-rwstate (tm))

∧ ((tm-clock (tm-execute (opcode,

tm))

= tm-clock (tm))

∧ ((tm-iports (tm-execute (opcode,

tm))

= tm-iports (tm))

∧ (tm-oports (tm-execute (opcode,

tm))

= tm-oports (tm)))))))))

Event: Disable registers-untouched-by-tm-execute.

Theorem: registers-untouched-by-tm-fetch-execute (¬ tm-in-supervisor-mode (tm)) → ((tm-base (tm-fetch-execute (tm)) = tm-base (tm))

∧ ((tm-limit (tm-fetch-execute (tm)) = tm-limit (tm))

∧ ((tm-slimit (tm-fetch-execute (tm)) = tm-slimit (tm))

∧ ((tm-svmode (tm-fetch-execute (tm)) = tm-svmode (tm)) ∧ ((tm-rwstate (tm-fetch-execute (tm))

= tm-rwstate (tm))

∧ ((tm-iports (tm-fetch-execute (tm)) = tm-iports (tm)) ∧ (tm-oports (tm-fetch-execute (tm)) = tm-oports (tm))))))))

Event: Disable registers-untouched-by-tm-fetch-execute.

Theorem: tm-clock-tm-fetch-execute ((¬ tm-in-supervisor-mode (tm)) ∧ (¬ tm-clock-interruptp (tm))) → (tm-clock (tm-fetch-execute (tm)) = (tm-clock (tm) − 1))

Event: Disable tm-clock-tm-fetch-execute.

Definition: base-limit (base, limit) = cons (base, cons (limit, 'nil))

Definition: base (base-limit) = car (base-limit)

Definition: limit (base-limit) = car (cdr (base-limit))

Definition: disjoint (b1 , l1 , b2 , l2 ) = (if b2 < (b1 + l1 ) then '*1*false

else '*1*true endif

∨ if b1 < (b2 + l2 ) then '*1*false else '*1*true endif)

Theorem: symmetry-of-disjoint disjoint (b2 , l2 , b1 , l1 ) = disjoint (b1 , l1 , b2 , l2 )

Event: Disable symmetry-of-disjoint.

Definition: disjoint-everywhere (b, l, table) = if listp (table)

then disjoint (b, l, base (car (table)), limit (car (table))) ∧ disjoint-everywhere (b, l, cdr (table))

else '*1*true endif

Definition: mutually-disjoint (table) = if listp (table)

then disjoint-everywhere (base (car (table)), limit (car (table)), cdr (table))

∧ mutually-disjoint (cdr (table)) else '*1*true endif

Definition: finite-segment-tablep (table, max) = if listp (table)

then if max < (base (car (table)) + limit (car (table)))

         then '*1*false

else '*1*true endif

∧ finite-segment-tablep (cdr (table), max) else '*1*true endif Theorem: disjoint-getnth (disjoint-everywhere (b, l, table) ∧ (i < length (table))) → disjoint (b, l, base (getnth (i, table)), limit (getnth (i, table)))

Event: Disable disjoint-getnth.

Theorem: tm-good-address-tm-set-cc tm-good-address (addr, tm-set-cc (cc, tm)) = tm-good-address (addr, tm)

Event: Disable tm-good-address-tm-set-cc.

Theorem: tm-good-address-tm-set-pc tm-good-address (addr, tm-set-pc (pc, tm)) = tm-good-address (addr, tm)

Event: Disable tm-good-address-tm-set-pc.

Theorem: tm-good-address-tm-set-sp tm-good-address (addr, tm-set-sp (sp, tm)) = tm-good-address (addr, tm)

Event: Disable tm-good-address-tm-set-sp.

Theorem: tm-store-in-memory-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ finite-numberp (addr,

min ('65536 − tm-base (tm), tm-limit (tm)))))

→ (getseg (b, l, tm-memory (tm-store-in-memory (value, addr, tm))) = getseg (b, l, tm-memory (tm)))

Event: Disable tm-store-in-memory-protection-theorem.

Theorem: tm-store-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm)) ∧ tm-good-address (addr, tm))) → (getseg (b, l, tm-memory (tm-store (value, addr, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-store-protection-theorem.

Theorem: tm-execute-add-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ tm-good-address (addr1 , tm))) → (getseg (b, l, tm-memory (tm-execute-add (addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-add-protection-theorem.

Theorem: tm-execute-branch-protection-theorem tm-memory (tm-execute-branch (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-branch-protection-theorem.

Theorem: tm-execute-branch-on-zero-protection-theorem tm-memory (tm-execute-branch-on-zero (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-branch-on-zero-protection-theorem.

Theorem: tm-execute-branch-not-zero-protection-theorem tm-memory (tm-execute-branch-not-zero (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-branch-not-zero-protection-theorem.

Theorem: tm-execute-call-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm)) ∧ tm-good-address (addr, tm))) → (getseg (b, l, tm-memory (tm-execute-call (addr, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-call-protection-theorem.

Theorem: tm-execute-compare-protection-theorem tm-memory (tm-execute-compare (addr1 , addr2 , tm)) = tm-memory (tm)

Event: Disable tm-execute-compare-protection-theorem.

Theorem: tm-execute-decr-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm)) ∧ tm-good-address (addr, tm))) → (getseg (b, l, tm-memory (tm-execute-decr (addr, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-decr-protection-theorem.

Theorem: tm-execute-decr-mod-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ tm-good-address (addr1 , tm))) → (getseg (b, l, tm-memory (tm-execute-decr-mod (addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-decr-mod-protection-theorem.

Theorem: tm-execute-incr-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm)) ∧ tm-good-address (addr, tm))) → (getseg (b, l, tm-memory (tm-execute-incr (addr, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-incr-protection-theorem.

Theorem: tm-execute-incr-mod-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ tm-good-address (addr1 , tm))) → (getseg (b, l, tm-memory (tm-execute-incr-mod (addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-incr-mod-protection-theorem.

Theorem: tm-execute-load-base-protection-theorem tm-memory (tm-execute-load-base (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-load-base-protection-theorem.

Theorem: tm-execute-load-limit-protection-theorem tm-memory (tm-execute-load-limit (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-load-limit-protection-theorem.

Theorem: tm-execute-load-psw-protection-theorem tm-memory (tm-execute-load-psw (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-load-psw-protection-theorem.

Theorem: tm-execute-mod-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ tm-good-address (addr1 , tm))) → (getseg (b, l, tm-memory (tm-execute-mod (addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-mod-protection-theorem.

Theorem: tm-execute-move-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ tm-good-address (addr1 , tm))) → (getseg (b, l, tm-memory (tm-execute-move (addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-move-protection-theorem.

Theorem: tm-execute-multiply-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ (disjoint (b, l, tm-base (tm), tm-limit (tm))

∧ tm-good-address (addr1 , tm))) → (getseg (b, l, tm-memory (tm-execute-multiply (addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-multiply-protection-theorem.

Theorem: tm-execute-return-protection-theorem tm-memory (tm-execute-return (tm)) = tm-memory (tm)

Event: Disable tm-execute-return-protection-theorem.

Theorem: tm-execute-test-iport-protection-theorem tm-memory (tm-execute-test-iport (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-test-iport-protection-theorem.

Theorem: tm-execute-test-oport-protection-theorem tm-memory (tm-execute-test-oport (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-test-oport-protection-theorem.

Theorem: tm-execute-set-clock-protection-theorem tm-memory (tm-execute-set-clock (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-set-clock-protection-theorem.

Theorem: tm-execute-run-protection-theorem tm-memory (tm-execute-run (tm)) = tm-memory (tm)

Event: Disable tm-execute-run-protection-theorem.

Theorem: tm-execute-wait-protection-theorem tm-memory (tm-execute-wait (tm)) = tm-memory (tm)

Event: Disable tm-execute-wait-protection-theorem.

Theorem: tm-execute-start-output-protection-theorem tm-memory (tm-execute-start-output (addr1 , addr2 , tm)) = tm-memory (tm)

Event: Disable tm-execute-start-output-protection-theorem.

Theorem: tm-execute-post-output-interrupt-protection-theorem tm-memory (tm-execute-post-output-interrupt (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-post-output-interrupt-protection-theorem.

Theorem: tm-execute-svc-protection-theorem tm-memory (tm-execute-svc (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-svc-protection-theorem.

Theorem: tm-execute-svc-return-protection-theorem tm-memory (tm-execute-svc-return (addr, tm)) = tm-memory (tm)

Event: Disable tm-execute-svc-return-protection-theorem.

Theorem: tm-execute-nullary-protection-theorem tm-memory (tm-execute-nullary (opcode, tm)) = tm-memory (tm)

Event: Disable tm-execute-nullary-protection-theorem.

Theorem: tm-execute-unary-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ disjoint (b, l, tm-base (tm), tm-limit (tm))) → (getseg (b, l, tm-memory (tm-execute-unary (opcode, addr, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-unary-protection-theorem.

Theorem: tm-execute-binary-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ disjoint (b, l, tm-base (tm), tm-limit (tm))) → (getseg (b, l, tm-memory (tm-execute-binary (opcode, addr1 , addr2 , tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-binary-protection-theorem.

Theorem: tm-execute-instruction-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ disjoint (b, l, tm-base (tm), tm-limit (tm))) → (getseg (b, l, tm-memory (tm-execute-instruction (instruction, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-instruction-protection-theorem.

Theorem: tm-execute-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ disjoint (b, l, tm-base (tm), tm-limit (tm))) → (getseg (b, l, tm-memory (tm-execute (opcode, tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-execute-protection-theorem.

Theorem: tm-fetch-execute-protection-theorem ((¬ tm-in-supervisor-mode (tm)) ∧ disjoint (b, l, tm-base (tm), tm-limit (tm))) → (getseg (b, l, tm-memory (tm-fetch-execute (tm)))

= getseg (b, l, tm-memory (tm)))

Event: Disable tm-fetch-execute-protection-theorem.

Theorem: length-tm-memory-tm-store length (tm-memory (tm-store (value, addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-store.

Theorem: length-tm-memory-tm-execute-add length (tm-memory (tm-execute-add (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-add.

Theorem: length-tm-memory-tm-execute-branch length (tm-memory (tm-execute-branch (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-branch.

Theorem: length-tm-memory-tm-execute-branch-on-zero length (tm-memory (tm-execute-branch-on-zero (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-branch-on-zero.

Theorem: length-tm-memory-tm-execute-branch-not-zero length (tm-memory (tm-execute-branch-not-zero (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-branch-not-zero.

Theorem: length-tm-memory-tm-execute-call length (tm-memory (tm-execute-call (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-call.

Theorem: length-tm-memory-tm-execute-compare length (tm-memory (tm-execute-compare (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-compare.

Theorem: length-tm-memory-tm-execute-decr length (tm-memory (tm-execute-decr (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-decr.

Theorem: length-tm-memory-tm-execute-decr-mod length (tm-memory (tm-execute-decr-mod (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-decr-mod.

Theorem: length-tm-memory-tm-execute-incr length (tm-memory (tm-execute-incr (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-incr.

Theorem: length-tm-memory-tm-execute-incr-mod length (tm-memory (tm-execute-incr-mod (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-incr-mod.

Theorem: length-tm-memory-tm-execute-load-base length (tm-memory (tm-execute-load-base (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-load-base.

Theorem: length-tm-memory-tm-execute-load-limit length (tm-memory (tm-execute-load-limit (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-load-limit.

Theorem: length-tm-memory-tm-execute-load-psw length (tm-memory (tm-execute-load-psw (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-load-psw.

Theorem: length-tm-memory-tm-execute-mod length (tm-memory (tm-execute-mod (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-mod.

Theorem: length-tm-memory-tm-execute-move length (tm-memory (tm-execute-move (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-move.

Theorem: length-tm-memory-tm-execute-multiply length (tm-memory (tm-execute-multiply (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-multiply.

Theorem: length-tm-memory-tm-execute-return length (tm-memory (tm-execute-return (tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-return.

Theorem: length-tm-memory-tm-execute-test-iport length (tm-memory (tm-execute-test-iport (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-test-iport.

Theorem: length-tm-memory-tm-execute-test-oport length (tm-memory (tm-execute-test-oport (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-test-oport.

Theorem: length-tm-memory-tm-execute-set-clock length (tm-memory (tm-execute-set-clock (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-set-clock.

Theorem: length-tm-memory-tm-execute-run length (tm-memory (tm-execute-run (tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-run.

Theorem: length-tm-memory-tm-execute-wait length (tm-memory (tm-execute-wait (tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-wait.

Theorem: length-tm-memory-tm-execute-post-output-interrupt length (tm-memory (tm-execute-post-output-interrupt (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-post-output-interrupt.

Theorem: length-tm-memory-tm-execute-start-output length (tm-memory (tm-execute-start-output (addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-start-output.

Theorem: length-tm-memory-tm-execute-svc length (tm-memory (tm-execute-svc (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-svc.

Theorem: length-tm-memory-tm-execute-svc-return length (tm-memory (tm-execute-svc-return (addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-svc-return.

Theorem: length-tm-memory-tm-execute-nullary length (tm-memory (tm-execute-nullary (opcode, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-nullary.

Theorem: length-tm-memory-tm-execute-unary length (tm-memory (tm-execute-unary (opcode, addr, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-unary.

Theorem: length-tm-memory-tm-execute-binary length (tm-memory (tm-execute-binary (opcode, addr1 , addr2 , tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-binary.

Theorem: length-tm-memory-tm-execute-instruction length (tm-memory (tm-execute-instruction (instruction, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute-instruction.

Theorem: length-tm-memory-tm-execute length (tm-memory (tm-execute (instruction, tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-execute.

Theorem: length-tm-memory-tm-fetch-execute length (tm-memory (tm-fetch-execute (tm))) = length (tm-memory (tm))

Event: Disable length-tm-memory-tm-fetch-execute.

(DEFN
 GOOD-ADDRESS-SPACE

 (X MEMLENGTH)
 (AND
  (TM-SHELLP X)
  (AND
   (NUMBERP MEMLENGTH)
   (AND
    (IF (LESSP '65536 MEMLENGTH)
        '*1*FALSE
        '*1*TRUE)
    (AND
     (PLISTP (TM-MEMORY X))
     (AND
      (FINITE-NUMBER-LISTP (TM-MEMORY X)
                           '65536)
      (AND
       (EQUAL (LENGTH (TM-MEMORY X))
              MEMLENGTH)
       (AND
         (PLISTP (TM-REGS X))
         (AND (FINITE-NUMBER-LISTP (TM-REGS X)
                                   '65536)
              (AND (EQUAL (LENGTH (TM-REGS X)) '8)
                   (AND (FINITE-NUMBERP (TM-CC X) '4)
                        (AND (FINITE-NUMBERP (TM-ERROR X) '64)
                             (AND (FINITE-NUMBERP (TM-SVCFLAG X) '2)
                                  (AND (FINITE-NUMBERP (TM-SVCID X) '128)
                                       (AND (EQUAL (TM-BASE X) '0)
                                            (AND (EQUAL (TM-LIMIT X) MEMLENGTH)
                                                 (EQUAL (TM-SVMODE X)
                                                        '0))))))))))))))))
 NIL)

Theorem: tm-shellp-address-space good-address-space (address-space, memlength) → tm-shellp (address-space)

Event: Disable tm-shellp-address-space.

Theorem: non-number-memlength-gives-bad-address-space (memlength ∉ N) → (¬ good-address-space (address-space, memlength))

Event: Disable non-number-memlength-gives-bad-address-space.

Theorem: address-space-memlength good-address-space (address-space, memlength)

→ if '65536 < memlength then '*1*false else '*1*true endif

Theorem: plistp-address-space-memory good-address-space (address-space, memlength) → plistp (tm-memory (address-space))

Event: Disable plistp-address-space-memory.

Theorem: finite-number-listp-address-space-memory good-address-space (address-space, memlength) → finite-number-listp (tm-memory (address-space), '65536)

Event: Disable finite-number-listp-address-space-memory.

Theorem: length-address-space-memory good-address-space (address-space, memlength) → (length (tm-memory (address-space)) = memlength)

Event: Disable length-address-space-memory.

Theorem: plistp-address-space-regs good-address-space (address-space, memlength) → plistp (tm-regs (address-space))

Event: Disable plistp-address-space-regs.

Theorem: finite-number-listp-address-space-regs good-address-space (address-space, memlength) → finite-number-listp (tm-regs (address-space), '65536)

Event: Disable finite-number-listp-address-space-regs.

Theorem: length-address-space-regs good-address-space (address-space, memlength) → (length (tm-regs (address-space)) = '8)

Event: Disable length-address-space-regs.

Theorem: finite-numberp-address-space-cc good-address-space (address-space, memlength) → finite-numberp (tm-cc (address-space), '4)

Event: Disable finite-numberp-address-space-cc.

Theorem: finite-numberp-address-space-error good-address-space (address-space, memlength) → finite-numberp (tm-error (address-space), '64)

Event: Disable finite-numberp-address-space-error.

Theorem: finite-numberp-address-space-svcflag good-address-space (address-space, memlength) → finite-numberp (tm-svcflag (address-space), '2)

Event: Disable finite-numberp-address-space-svcflag.

Theorem: finite-numberp-address-space-svcid good-address-space (address-space, memlength) → finite-numberp (tm-svcid (address-space), '128)

Event: Disable finite-numberp-address-space-svcid.

Theorem: finite-numberp-address-space-pc good-address-space (address-space, memlength) → finite-numberp (tm-pc (address-space), '65536)

Event: Disable finite-numberp-address-space-pc.

Theorem: finite-numberp-address-space-sp good-address-space (address-space, memlength) → finite-numberp (tm-sp (address-space), '65536)

Event: Disable finite-numberp-address-space-sp.

Theorem: tm-base-address-space good-address-space (address-space, memlength) → (tm-base (address-space) = '0)

Event: Disable tm-base-address-space.

Theorem: tm-limit-address-space good-address-space (address-space, memlength) → (tm-limit (address-space) = memlength)

Event: Disable tm-limit-address-space.

Theorem: tm-svmode-address-space good-address-space (address-space, memlength) → (tm-svmode (address-space) = '0)

Event: Disable tm-svmode-address-space.

Theorem: tm-in-supervisor-mode-good-address-space good-address-space (address-space, memlength) → (tm-in-supervisor-mode (address-space) = '*1*false)

Event: Disable tm-in-supervisor-mode-good-address-space.

Event: Let us define the theory good-address-space-properties to consist of the following events: tm-in-supervisor-mode-good-address-space, non-number-memlength-gives-bad-address-space, tm-svmode-address-space, tm-limit-address-space, tm-base-address-space, finite-numberp-address-space-svcid, finite-numberp-address-space-svcflag, finite-numberp-address-space-error, finite-numberp-address-space-cc, length-address-space-regs, finite-number-listp-address-space-regs, plistpaddress-space-regs, length-address-space-memory, finite-number-listp-address-space-memory, plistp-address-space-memory, address-space-memlength, tm-shellp-address-space, finite-numberp-address-space-pc, finite-numberp-address-space-sp.

Theorem: good-address-space-base-limit-property good-address-space (address-space, memlength) → (min ('65536 − tm-base (address-space), tm-limit (address-space))

= tm-limit (address-space))

Event: Disable good-address-space-base-limit-property.

Theorem: min-tm-memlength-memlength-in-good-address-space good-address-space (address-space, memlength) → (min ('65536, memlength) = memlength)

Event: Disable min-tm-memlength-memlength-in-good-address-space.

Theorem: good-memory-address-implies-non-zero-limit-for-address-space (good-address-space (address-space, memlength) ∧ tm-good-address (real-addr ('2, pc), address-space)) → (tm-limit (address-space) ≄ 0)

Theorem: finite-numberp-tm-good-address-for-address-space (good-address-space (address-space, memlength) ∧ tm-good-address (real-addr ('2, n), address-space)) → finite-numberp (n, memlength)

Event: Disable finite-numberp-tm-good-address-for-address-space.

Theorem: finite-numberp-tm-fetch-from-address-space (good-address-space (address-space, memlength) ∧ tm-good-address (addr, address-space)) → finite-numberp (tm-fetch (addr, address-space), '65536)

Event: Disable finite-numberp-tm-fetch-from-address-space.

Theorem: address-space-good-memory-tm-store (good-address-space (address-space, memlength) ∧ finite-numberp (value, '65536)) → (plistp (tm-memory (tm-store (value, addr, address-space)))

∧ ((length (tm-memory (tm-store (value, addr, address-space))) = fix (memlength)) ∧ finite-number-listp (tm-memory (tm-store (value,

addr,

address-space)),

                             '65536)))

Event: Disable address-space-good-memory-tm-store.

Theorem: address-space-good-regs-tm-store (good-address-space (address-space, memlength) ∧ finite-numberp (value, '65536)) → (plistp (tm-regs (tm-store (value, addr, address-space)))

∧ ((length (tm-regs (tm-store (value, addr, address-space))) = '8)

∧ finite-number-listp (tm-regs (tm-store (value, addr, address-space)),

                             '65536)))

Event: Disable address-space-good-regs-tm-store.

Theorem: good-address-space-tm-store (good-address-space (address-space, memlength) ∧ finite-numberp (value, '65536)) → good-address-space (tm-store (value, addr, address-space), memlength)

Event: Disable good-address-space-tm-store.

Theorem: good-address-space-tm-set-cc (good-address-space (address-space, memlength) ∧ finite-numberp (cc, '4)) → good-address-space (tm-set-cc (cc, address-space), memlength)

Event: Disable good-address-space-tm-set-cc.

Theorem: good-address-space-tm-set-error (good-address-space (address-space, memlength) ∧ finite-numberp (error, '64)) → good-address-space (tm-set-error (error, address-space), memlength)

Event: Disable good-address-space-tm-set-error.

Theorem: good-address-space-tm-set-svcflag (good-address-space (address-space, memlength) ∧ finite-numberp (svcflag, '2)) → good-address-space (tm-set-svcflag (svcflag, address-space), memlength)

Event: Disable good-address-space-tm-set-svcflag.

Theorem: good-address-space-tm-set-svcid (good-address-space (address-space, memlength) ∧ finite-numberp (svcid, '128)) → good-address-space (tm-set-svcid (svcid, address-space), memlength)

Event: Disable good-address-space-tm-set-svcid.

Theorem: good-address-space-tm-set-pc (good-address-space (address-space, memlength) ∧ finite-numberp (pc, '65536)) → good-address-space (tm-set-pc (pc, address-space), memlength)

Event: Disable good-address-space-tm-set-pc.

Theorem: good-address-space-tm-set-sp (good-address-space (address-space, memlength) ∧ finite-numberp (sp, '65536)) → good-address-space (tm-set-sp (sp, address-space), memlength)

Event: Disable good-address-space-tm-set-sp.

Theorem: good-address-space-tm-execute-add good-address-space (address-space, memlength) → good-address-space (tm-execute-add (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-add.

Theorem: good-address-space-tm-execute-branch (good-address-space (address-space, memlength) ∧ tm-good-address (addr, address-space)) → good-address-space (tm-execute-branch (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-branch.

Theorem: good-address-space-tm-execute-branch-on-zero (good-address-space (address-space, memlength) ∧ tm-good-address (addr, address-space)) → good-address-space (tm-execute-branch-on-zero (addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-branch-on-zero.

Theorem: good-address-space-tm-execute-branch-not-zero (good-address-space (address-space, memlength) ∧ tm-good-address (addr, address-space)) → good-address-space (tm-execute-branch-not-zero (addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-branch-not-zero.

Theorem: good-address-space-tm-execute-call (good-address-space (address-space, memlength) ∧ tm-good-address (addr, address-space)) → good-address-space (tm-execute-call (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-call.

Theorem: good-address-space-tm-execute-compare good-address-space (address-space, memlength) → good-address-space (tm-execute-compare (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-compare.

Theorem: good-address-space-tm-execute-decr good-address-space (address-space, memlength) → good-address-space (tm-execute-decr (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-decr.

Theorem: good-address-space-tm-execute-decr-mod good-address-space (address-space, memlength) → good-address-space (tm-execute-decr-mod (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-decr-mod.

Theorem: good-address-space-tm-execute-incr good-address-space (address-space, memlength) → good-address-space (tm-execute-incr (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-incr.

Theorem: good-address-space-tm-execute-incr-mod good-address-space (address-space, memlength) → good-address-space (tm-execute-incr-mod (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-incr-mod.

Theorem: good-address-space-tm-execute-load-base good-address-space (address-space, memlength) → good-address-space (tm-execute-load-base (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-load-base.

Theorem: good-address-space-tm-execute-load-limit good-address-space (address-space, memlength) → good-address-space (tm-execute-load-limit (addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-load-limit.

Theorem: good-address-space-tm-execute-load-psw good-address-space (address-space, memlength) → good-address-space (tm-execute-load-psw (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-load-psw.

Theorem: good-address-space-tm-execute-mod good-address-space (address-space, memlength) → good-address-space (tm-execute-mod (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-mod.

Theorem: good-address-space-tm-execute-move (good-address-space (address-space, memlength) ∧ tm-good-address (addr2 , address-space)) → good-address-space (tm-execute-move (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-move.

Theorem: good-address-space-tm-execute-multiply good-address-space (address-space, memlength) → good-address-space (tm-execute-multiply (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-multiply.

Theorem: finite-numberp-add1-address-space-sp (good-address-space (address-space, memlength) ∧ (¬ tm-stack-underflowp (address-space))) → finite-numberp (1 + tm-sp (address-space), '65536)

Event: Disable finite-numberp-add1-address-space-sp.

Theorem: min-memlength-tm-memlength-in-good-address-space good-address-space (address-space, memlength) → (min ('65536, memlength) = memlength)

Theorem: finite-numberp-tm-incr-memlength ((memlength ∈ N) ∧ ((min ('65536, memlength) = memlength) ∧ (b < (memlength − 1)))) → finite-numberp (tm-incr (b), memlength)

Event: Disable finite-numberp-tm-incr-memlength.

Theorem: tm-good-address-tm-incr-tm-sp-for-address-space (good-address-space (address-space, memlength) ∧ (¬ tm-stack-underflowp (address-space)))

→ tm-good-address (real-addr ('2, tm-incr (tm-sp (address-space))), address-space)

Event: Disable tm-good-address-tm-incr-tm-sp-for-address-space.

Theorem: good-address-space-tm-execute-return good-address-space (address-space, memlength) → good-address-space (tm-execute-return (address-space), memlength)

Event: Disable good-address-space-tm-execute-return.

Theorem: good-address-space-tm-execute-set-clock good-address-space (address-space, memlength) → good-address-space (tm-execute-set-clock (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-set-clock.

Theorem: good-address-space-tm-execute-run good-address-space (address-space, memlength) → good-address-space (tm-execute-run (address-space), memlength)

Event: Disable good-address-space-tm-execute-run.

Theorem: good-address-space-tm-execute-wait good-address-space (address-space, memlength) → good-address-space (tm-execute-wait (address-space), memlength)

Event: Disable good-address-space-tm-execute-wait.

Theorem: good-address-space-tm-execute-test-iport good-address-space (address-space, memlength) → good-address-space (tm-execute-test-iport (addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-test-iport.

Theorem: good-address-space-tm-execute-test-oport good-address-space (address-space, memlength) → good-address-space (tm-execute-test-oport (addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-test-oport.

Theorem: good-address-space-tm-execute-start-output good-address-space (address-space, memlength) → good-address-space (tm-execute-start-output (addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-start-output.

Theorem: good-address-space-tm-execute-post-output-interrupt good-address-space (address-space, memlength) → good-address-space (tm-execute-post-output-interrupt (addr,

address-space),

memlength)

Event: Disable good-address-space-tm-execute-post-output-interrupt.

Theorem: good-address-space-tm-execute-svc (good-address-space (address-space, memlength) ∧ tm-good-address (addr, address-space)) → good-address-space (tm-execute-svc (addr, address-space), memlength)

Event: Disable good-address-space-tm-execute-svc.

Theorem: good-address-space-tm-execute-svc-return good-address-space (address-space, memlength) → good-address-space (tm-execute-svc-return (addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-svc-return.

Theorem: good-address-space-tm-execute-nullary good-address-space (address-space, memlength) → good-address-space (tm-execute-nullary (opcode, address-space), memlength)

Event: Disable good-address-space-tm-execute-nullary.

Theorem: good-address-space-tm-execute-unary good-address-space (address-space, memlength) → good-address-space (tm-execute-unary (opcode, addr, address-space),

memlength)

Event: Disable good-address-space-tm-execute-unary.

Theorem: good-address-space-tm-execute-binary good-address-space (address-space, memlength) → good-address-space (tm-execute-binary (opcode, addr1 , addr2 , address-space),

memlength)

Event: Disable good-address-space-tm-execute-binary.

Theorem: good-address-space-tm-execute-instruction good-address-space (address-space, memlength) → good-address-space (tm-execute-instruction (instruction, address-space),

memlength)

Event: Disable good-address-space-tm-execute-instruction.

Theorem: good-address-space-tm-execute good-address-space (address-space, memlength) → good-address-space (tm-execute (instruction, address-space), memlength)

Event: Disable good-address-space-tm-execute.

Theorem: good-address-space-tm-decrement-clock good-address-space (address-space, memlength) → good-address-space (tm-decrement-clock (address-space), memlength)

Event: Disable good-address-space-tm-decrement-clock.

Theorem: good-address-space-tm-fetch-execute good-address-space (address-space, memlength) → good-address-space (tm-fetch-execute (address-space), memlength)

Event: Disable good-address-space-tm-fetch-execute.

Definition: mapup-address-space (memory, regs, cc, error, svcflag, svcid, base, limit) = tm (getseg (base, limit, memory),

regs, cc, error, svcflag, svcid,

       '0,

fix (limit),

'0,
'0,
'0,
'0,
'0)

(PROVE-LEMMA GOOD-ADDRESS-SPACE-MAPUP-ADDRESS-SPACE
(REWRITE)
(IMPLIES
(AND
(FINITE-NUMBER-LISTP MEMORY '65536)
(AND (NUMBERP LIMIT)
   (AND (IF (LESSP '65536 (LENGTH MEMORY))
            '*1*FALSE
            '*1*TRUE)
        (AND (PLISTP REGS)
             (AND (FINITE-NUMBER-LISTP REGS '65536)
                  (AND (EQUAL (LENGTH REGS) '8)
                       (AND (FINITE-NUMBERP CC '4)
                            (AND (FINITE-NUMBERP ERROR '64)
                                 (AND (FINITE-NUMBERP SVCFLAG '2)
                                      (AND (FINITE-NUMBERP SVCID '128)
                                           (IF (LESSP (LENGTH MEMORY)
                                                      (PLUS BASE LIMIT))
                                               '*1*FALSE
                                               '*1*TRUE)))))))))))
(GOOD-ADDRESS-SPACE (MAPUP-ADDRESS-SPACE MEMORY REGS CC ERROR SVCFLAG SVCID
                                    BASE LIMIT)
               LIMIT))
((ENABLE GOOD-ADDRESS-SPACE MAPUP-ADDRESS-SPACE PLISTP-GETSEG LENGTH-GETSEG
   FINITE-NUMBER-LISTP-GETSEG)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable good-address-space-mapup-address-space.

Theorem: tm-fetch-from-memory-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm)) ∧ (addr < tm-limit (tm)))) → (tm-fetch-from-memory (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-fetch-from-memory (addr, tm))

Event: Disable tm-fetch-from-memory-mapup-address-space.

Theorem: tm-fetch-from-regmem-mapup-address-space good-tm (tm) → (tm-fetch-from-regmem (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-fetch-from-regmem (addr, tm))

Event: Disable tm-fetch-from-regmem-mapup-address-space.

Theorem: lessp-good-memory-address-limit (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ ((real-addr-source (addr) ≄ 0)

∧ ((real-addr-source (addr) ≠ '1)

∧ tm-good-address (addr, tm)))))

→ (real-addr-num (addr) < tm-limit (tm))

Theorem: tm-fetch-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm)) ∧ tm-good-address (addr, tm))) → (tm-fetch (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-fetch (addr, tm))

Event: Disable tm-fetch-mapup-address-space.

Theorem: tm-store-in-memory-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (addr < tm-limit (tm)))))

→ (tm-store-in-memory (value, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-store-in-memory (value, addr, tm)),

tm-regs (tm-store-in-memory (value, addr, tm)), tm-cc (tm-store-in-memory (value, addr, tm)), tm-error (tm-store-in-memory (value, addr, tm)), tm-svcflag (tm-store-in-memory (value,

addr, tm)),

tm-svcid (tm-store-in-memory (value, addr, tm)), tm-base (tm-store-in-memory (value, addr, tm)), tm-limit (tm-store-in-memory (value, addr, tm))))

Event: Disable tm-store-in-memory-commutes-with-mapup-address-space.

Theorem: tm-store-in-regmem-commutes-with-mapup-address-space good-tm (tm) → (tm-store-in-regmem (value,

addr, mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-store-in-regmem (value, addr, tm)),

tm-regs (tm-store-in-regmem (value, addr, tm)), tm-cc (tm-store-in-regmem (value, addr, tm)), tm-error (tm-store-in-regmem (value, addr, tm)), tm-svcflag (tm-store-in-regmem (value,

addr, tm)),

tm-svcid (tm-store-in-regmem (value, addr, tm)), tm-base (tm-store-in-regmem (value, addr, tm)), tm-limit (tm-store-in-regmem (value, addr, tm))))

Event: Disable tm-store-in-regmem-commutes-with-mapup-address-space.

Theorem: tm-store-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (addr, tm))))

→ (tm-store (value, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-store (value, addr, tm)), tm-regs (tm-store (value, addr, tm)), tm-cc (tm-store (value, addr, tm)), tm-error (tm-store (value, addr, tm)), tm-svcflag (tm-store (value, addr, tm)), tm-svcid (tm-store (value, addr, tm)), tm-base (tm-store (value, addr, tm)), tm-limit (tm-store (value, addr, tm))))

Event: Disable tm-store-commutes-with-mapup-address-space.

Theorem: tm-set-pc-commutes-with-mapup-address-space tm-set-pc (pc,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-set-pc (pc, tm)), tm-regs (tm-set-pc (pc, tm)), tm-cc (tm-set-pc (pc, tm)), tm-error (tm-set-pc (pc, tm)), tm-svcflag (tm-set-pc (pc, tm)), tm-svcid (tm-set-pc (pc, tm)), tm-base (tm-set-pc (pc, tm)), tm-limit (tm-set-pc (pc, tm)))

Event: Disable tm-set-pc-commutes-with-mapup-address-space.

Theorem: tm-set-sp-commutes-with-mapup-address-space tm-set-sp (sp,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-set-sp (sp, tm)), tm-regs (tm-set-sp (sp, tm)), tm-cc (tm-set-sp (sp, tm)), tm-error (tm-set-sp (sp, tm)), tm-svcflag (tm-set-sp (sp, tm)), tm-svcid (tm-set-sp (sp, tm)), tm-base (tm-set-sp (sp, tm)), tm-limit (tm-set-sp (sp, tm)))

Event: Disable tm-set-sp-commutes-with-mapup-address-space.

Theorem: tm-set-cc-commutes-with-mapup-address-space tm-set-cc (cc,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-set-cc (cc, tm)), tm-regs (tm-set-cc (cc, tm)), tm-cc (tm-set-cc (cc, tm)), tm-error (tm-set-cc (cc, tm)), tm-svcflag (tm-set-cc (cc, tm)), tm-svcid (tm-set-cc (cc, tm)), tm-base (tm-set-cc (cc, tm)), tm-limit (tm-set-cc (cc, tm)))

Event: Disable tm-set-cc-commutes-with-mapup-address-space.

Theorem: tm-set-error-commutes-with-mapup-address-space tm-set-error (error,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-set-error (error, tm)), tm-regs (tm-set-error (error, tm)), tm-cc (tm-set-error (error, tm)), tm-error (tm-set-error (error, tm)), tm-svcflag (tm-set-error (error, tm)), tm-svcid (tm-set-error (error, tm)), tm-base (tm-set-error (error, tm)), tm-limit (tm-set-error (error, tm)))

Event: Disable tm-set-error-commutes-with-mapup-address-space.

Theorem: tm-set-svcflag-commutes-with-mapup-address-space tm-set-svcflag (svcflag,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-set-svcflag (svcflag, tm)), tm-regs (tm-set-svcflag (svcflag, tm)), tm-cc (tm-set-svcflag (svcflag, tm)), tm-error (tm-set-svcflag (svcflag, tm)), tm-svcflag (tm-set-svcflag (svcflag, tm)), tm-svcid (tm-set-svcflag (svcflag, tm)), tm-base (tm-set-svcflag (svcflag, tm)), tm-limit (tm-set-svcflag (svcflag, tm)))

Event: Disable tm-set-svcflag-commutes-with-mapup-address-space.

Theorem: tm-set-svcid-commutes-with-mapup-address-space tm-set-svcid (svcid,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-set-svcid (svcid, tm)), tm-regs (tm-set-svcid (svcid, tm)), tm-cc (tm-set-svcid (svcid, tm)), tm-error (tm-set-svcid (svcid, tm)), tm-svcflag (tm-set-svcid (svcid, tm)), tm-svcid (tm-set-svcid (svcid, tm)), tm-base (tm-set-svcid (svcid, tm)), tm-limit (tm-set-svcid (svcid, tm)))

Event: Disable tm-set-svcid-commutes-with-mapup-address-space.

Theorem: tm-in-supervisor-mode-tm-set-cc tm-in-supervisor-mode (tm-set-cc (cc, tm)) = tm-in-supervisor-mode (tm)

Event: Disable tm-in-supervisor-mode-tm-set-cc.

Theorem: tm-in-supervisor-mode-tm-set-svcflag tm-in-supervisor-mode (tm-set-svcflag (svcflag, tm)) = tm-in-supervisor-mode (tm)

Event: Disable tm-in-supervisor-mode-tm-set-svcflag.

Theorem: tm-in-supervisor-mode-tm-set-svcid tm-in-supervisor-mode (tm-set-svcid (svcid, tm)) = tm-in-supervisor-mode (tm)

Event: Disable tm-in-supervisor-mode-tm-set-svcid.

Theorem: tm-in-supervisor-mode-tm-set-sp tm-in-supervisor-mode (tm-set-sp (sp, tm)) = tm-in-supervisor-mode (tm)

Event: Disable tm-in-supervisor-mode-tm-set-sp.

Theorem: tm-in-supervisor-mode-tm-set-pc tm-in-supervisor-mode (tm-set-pc (pc, tm)) = tm-in-supervisor-mode (tm)

Event: Disable tm-in-supervisor-mode-tm-set-pc.

Theorem: tm-limit-mapup-address-space tm-limit (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= fix (tm-limit (tm))

Event: Disable tm-limit-mapup-address-space.

Theorem: tm-base-mapup-address-space tm-base (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= '0

Event: Disable tm-base-mapup-address-space.

Theorem: plus-tm-base-tm-limit-tm-set-cc (tm-base (tm-set-cc (cc, tm)) + tm-limit (tm-set-cc (cc, tm))) = (tm-base (tm) + tm-limit (tm))

Event: Disable plus-tm-base-tm-limit-tm-set-cc.

Theorem: plus-tm-base-tm-limit-tm-set-sp (tm-base (tm-set-sp (sp, tm)) + tm-limit (tm-set-sp (sp, tm))) = (tm-base (tm) + tm-limit (tm))

Event: Disable plus-tm-base-tm-limit-tm-set-sp.

Theorem: tm-execute-add-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

         then '*1*false

else '*1*true endif

∧ (tm-good-address (addr1 , tm)

∧ tm-good-address (addr2 , tm)))))

→ (tm-execute-add (addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-add (addr1 , addr2 , tm)), tm-regs (tm-execute-add (addr1 , addr2 , tm)), tm-cc (tm-execute-add (addr1 , addr2 , tm)), tm-error (tm-execute-add (addr1 , addr2 , tm)), tm-svcflag (tm-execute-add (addr1 , addr2 , tm)), tm-svcid (tm-execute-add (addr1 , addr2 , tm)), tm-base (tm-execute-add (addr1 , addr2 , tm)), tm-limit (tm-execute-add (addr1 , addr2 , tm))))

Event: Disable tm-execute-add-commutes-with-mapup-address-space.

Theorem: tm-execute-branch-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm)) ∧ tm-good-address (addr, tm))) → (tm-execute-branch (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-branch (addr, tm)), tm-regs (tm-execute-branch (addr, tm)), tm-cc (tm-execute-branch (addr, tm)), tm-error (tm-execute-branch (addr, tm)), tm-svcflag (tm-execute-branch (addr, tm)), tm-svcid (tm-execute-branch (addr, tm)), tm-base (tm-execute-branch (addr, tm)), tm-limit (tm-execute-branch (addr, tm))))

Event: Disable tm-execute-branch-commutes-with-mapup-address-space.

Theorem: tm-cc-mapup-address-space good-tm (tm) → (tm-cc (mapup-address-space (tm-memory (tm),

tm-regs (tm),

tm-cc (tm),

tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-cc (tm))

Event: Disable tm-cc-mapup-address-space.

Theorem: tm-error-mapup-address-space good-tm (tm) → (tm-error (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-error (tm))

Event: Disable tm-error-mapup-address-space.

Theorem: tm-svcflag-mapup-address-space good-tm (tm) → (tm-svcflag (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-svcflag (tm))

Event: Disable tm-svcflag-mapup-address-space.

Theorem: tm-svcid-mapup-address-space good-tm (tm) → (tm-svcid (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-svcid (tm))

Event: Disable tm-svcid-mapup-address-space.

Theorem: tm-pc-mapup-address-space good-tm (tm)

→ (tm-pc (mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-pc (tm))

Event: Disable tm-pc-mapup-address-space.

Theorem: tm-sp-mapup-address-space good-tm (tm) → (tm-sp (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-sp (tm))

Event: Disable tm-sp-mapup-address-space.

Theorem: tm-execute-branch-on-zero-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm)) ∧ tm-good-address (addr, tm))) → (tm-execute-branch-on-zero (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-branch-on-zero (addr,

tm)),

tm-regs (tm-execute-branch-on-zero (addr, tm)), tm-cc (tm-execute-branch-on-zero (addr, tm)), tm-error (tm-execute-branch-on-zero (addr,

tm)),

tm-svcflag (tm-execute-branch-on-zero (addr,

tm)),

tm-svcid (tm-execute-branch-on-zero (addr,

tm)),

tm-base (tm-execute-branch-on-zero (addr, tm)), tm-limit (tm-execute-branch-on-zero (addr,

tm))))

Event: Disable tm-execute-branch-on-zero-commutes-with-mapup-address-space.

Theorem: tm-execute-branch-not-zero-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm)) ∧ tm-good-address (addr, tm))) → (tm-execute-branch-not-zero (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-branch-not-zero (addr,

tm)),

tm-regs (tm-execute-branch-not-zero (addr,

tm)),

tm-cc (tm-execute-branch-not-zero (addr, tm)), tm-error (tm-execute-branch-not-zero (addr,

tm)),

tm-svcflag (tm-execute-branch-not-zero (addr,

tm)),

tm-svcid (tm-execute-branch-not-zero (addr,

tm)),

tm-base (tm-execute-branch-not-zero (addr,

tm)),

tm-limit (tm-execute-branch-not-zero (addr, tm))))

Event: Disable tm-execute-branch-not-zero-commutes-with-mapup-address-space.

Theorem: tm-stack-overflowp-mapup-address-space good-tm (tm)

→ (tm-stack-overflowp (mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-stack-overflowp (tm))

Event: Disable tm-stack-overflowp-mapup-address-space.

Theorem: tm-good-address-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-good-address (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-good-address (addr, tm))

Event: Disable tm-good-address-mapup-address-space.

Theorem: tm-execute-call-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (addr, tm))))

→ (tm-execute-call (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-call (addr, tm)), tm-regs (tm-execute-call (addr, tm)), tm-cc (tm-execute-call (addr, tm)), tm-error (tm-execute-call (addr, tm)), tm-svcflag (tm-execute-call (addr, tm)), tm-svcid (tm-execute-call (addr, tm)), tm-base (tm-execute-call (addr, tm)), tm-limit (tm-execute-call (addr, tm))))

Event: Disable tm-execute-call-commutes-with-mapup-address-space.

Theorem: tm-execute-compare-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (tm-good-address (addr1 , tm) ∧ tm-good-address (addr2 , tm)))) → (tm-execute-compare (addr1 ,

addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-compare (addr1 , addr2 , tm)),

tm-regs (tm-execute-compare (addr1 , addr2 , tm)), tm-cc (tm-execute-compare (addr1 , addr2 , tm)), tm-error (tm-execute-compare (addr1 ,

addr2 , tm)),

tm-svcflag (tm-execute-compare (addr1 , addr2 , tm)),

tm-svcid (tm-execute-compare (addr1 , addr2 , tm)),

tm-base (tm-execute-compare (addr1 , addr2 , tm)), tm-limit (tm-execute-compare (addr1 ,

addr2 ,

tm))))

Event: Disable tm-execute-compare-commutes-with-mapup-address-space.

Theorem: tm-execute-decr-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (addr, tm))))

→ (tm-execute-decr (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-decr (addr, tm)), tm-regs (tm-execute-decr (addr, tm)), tm-cc (tm-execute-decr (addr, tm)), tm-error (tm-execute-decr (addr, tm)), tm-svcflag (tm-execute-decr (addr, tm)), tm-svcid (tm-execute-decr (addr, tm)), tm-base (tm-execute-decr (addr, tm)), tm-limit (tm-execute-decr (addr, tm))))

Event: Disable tm-execute-decr-commutes-with-mapup-address-space.

Theorem: tm-execute-decr-mod-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (tm-good-address (addr1 , tm)

∧ tm-good-address (addr2 , tm)))))

→ (tm-execute-decr-mod (addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-decr-mod (addr1 , addr2 , tm)),

tm-regs (tm-execute-decr-mod (addr1 , addr2 , tm)),

tm-cc (tm-execute-decr-mod (addr1 , addr2 , tm)), tm-error (tm-execute-decr-mod (addr1 ,

addr2 , tm)),

tm-svcflag (tm-execute-decr-mod (addr1 , addr2 , tm)),

tm-svcid (tm-execute-decr-mod (addr1 , addr2 , tm)),

tm-base (tm-execute-decr-mod (addr1 , addr2 , tm)),

tm-limit (tm-execute-decr-mod (addr1 , addr2 , tm))))

Event: Disable tm-execute-decr-mod-commutes-with-mapup-address-space.

Theorem: tm-execute-incr-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (addr, tm))))

→ (tm-execute-incr (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-incr (addr, tm)), tm-regs (tm-execute-incr (addr, tm)), tm-cc (tm-execute-incr (addr, tm)), tm-error (tm-execute-incr (addr, tm)), tm-svcflag (tm-execute-incr (addr, tm)), tm-svcid (tm-execute-incr (addr, tm)), tm-base (tm-execute-incr (addr, tm)), tm-limit (tm-execute-incr (addr, tm))))

Event: Disable tm-execute-incr-commutes-with-mapup-address-space.

Theorem: tm-execute-incr-mod-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (tm-good-address (addr1 , tm)

∧ tm-good-address (addr2 , tm)))))

→ (tm-execute-incr-mod (addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-incr-mod (addr1 , addr2 , tm)),

tm-regs (tm-execute-incr-mod (addr1 , addr2 , tm)),

tm-cc (tm-execute-incr-mod (addr1 , addr2 , tm)), tm-error (tm-execute-incr-mod (addr1 ,

addr2 , tm)),

tm-svcflag (tm-execute-incr-mod (addr1 , addr2 , tm)),

tm-svcid (tm-execute-incr-mod (addr1 , addr2 , tm)), tm-base (tm-execute-incr-mod (addr1 ,

addr2 , tm)),

tm-limit (tm-execute-incr-mod (addr1 , addr2 , tm))))

Event: Disable tm-execute-incr-mod-commutes-with-mapup-address-space.

Theorem: tm-in-supervisor-mode-mapup-address-space tm-in-supervisor-mode (mapup-address-space (memory,

regs, cc, error, svcflag, svcid, base, limit))

= '*1*false

Event: Disable tm-in-supervisor-mode-mapup-address-space.

Theorem: tm-execute-load-base-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-load-base (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-load-base (addr, tm)), tm-regs (tm-execute-load-base (addr, tm)), tm-cc (tm-execute-load-base (addr, tm)), tm-error (tm-execute-load-base (addr, tm)), tm-svcflag (tm-execute-load-base (addr, tm)), tm-svcid (tm-execute-load-base (addr, tm)), tm-base (tm-execute-load-base (addr, tm)), tm-limit (tm-execute-load-base (addr, tm))))

Event: Disable tm-execute-load-base-commutes-with-mapup-address-space.

Theorem: tm-execute-load-limit-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-load-limit (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-load-limit (addr, tm)), tm-regs (tm-execute-load-limit (addr, tm)), tm-cc (tm-execute-load-limit (addr, tm)), tm-error (tm-execute-load-limit (addr, tm)), tm-svcflag (tm-execute-load-limit (addr, tm)), tm-svcid (tm-execute-load-limit (addr, tm)), tm-base (tm-execute-load-limit (addr, tm)), tm-limit (tm-execute-load-limit (addr, tm))))

Event: Disable tm-execute-load-limit-commutes-with-mapup-address-space.

Theorem: tm-execute-load-psw-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-load-psw (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-load-psw (addr, tm)), tm-regs (tm-execute-load-psw (addr, tm)), tm-cc (tm-execute-load-psw (addr, tm)), tm-error (tm-execute-load-psw (addr, tm)), tm-svcflag (tm-execute-load-psw (addr, tm)), tm-svcid (tm-execute-load-psw (addr, tm)), tm-base (tm-execute-load-psw (addr, tm)), tm-limit (tm-execute-load-psw (addr, tm))))

Event: Disable tm-execute-load-psw-commutes-with-mapup-address-space.

Theorem: tm-execute-mod-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (tm-good-address (addr1 , tm)

∧ tm-good-address (addr2 , tm)))))

→ (tm-execute-mod (addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-mod (addr1 , addr2 , tm)), tm-regs (tm-execute-mod (addr1 , addr2 , tm)), tm-cc (tm-execute-mod (addr1 , addr2 , tm)), tm-error (tm-execute-mod (addr1 , addr2 , tm)), tm-svcflag (tm-execute-mod (addr1 , addr2 , tm)), tm-svcid (tm-execute-mod (addr1 , addr2 , tm)), tm-base (tm-execute-mod (addr1 , addr2 , tm)), tm-limit (tm-execute-mod (addr1 , addr2 , tm))))

Event: Disable tm-execute-mod-commutes-with-mapup-address-space.

Theorem: tm-execute-move-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (tm-good-address (addr1 , tm)

∧ tm-good-address (addr2 , tm)))))

→ (tm-execute-move (addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-move (addr1 , addr2 , tm)), tm-regs (tm-execute-move (addr1 , addr2 , tm)), tm-cc (tm-execute-move (addr1 , addr2 , tm)), tm-error (tm-execute-move (addr1 , addr2 , tm)), tm-svcflag (tm-execute-move (addr1 , addr2 , tm)), tm-svcid (tm-execute-move (addr1 , addr2 , tm)), tm-base (tm-execute-move (addr1 , addr2 , tm)), tm-limit (tm-execute-move (addr1 , addr2 , tm))))

Event: Disable tm-execute-move-commutes-with-mapup-address-space.

Theorem: tm-execute-multiply-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (tm-good-address (addr1 , tm)

∧ tm-good-address (addr2 , tm)))))

→ (tm-execute-multiply (addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-multiply (addr1 , addr2 , tm)),

tm-regs (tm-execute-multiply (addr1 , addr2 , tm)),

tm-cc (tm-execute-multiply (addr1 , addr2 , tm)), tm-error (tm-execute-multiply (addr1 ,

addr2 , tm)),

tm-svcflag (tm-execute-multiply (addr1 , addr2 ,

tm)),

tm-svcid (tm-execute-multiply (addr1 , addr2 , tm)),

tm-base (tm-execute-multiply (addr1 , addr2 , tm)),

tm-limit (tm-execute-multiply (addr1 , addr2 , tm))))

Event: Disable tm-execute-multiply-commutes-with-mapup-address-space.

Theorem: tm-stack-underflowp-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-stack-underflowp (mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-stack-underflowp (tm))

Event: Disable tm-stack-underflowp-mapup-address-space.

Theorem: tm-execute-return-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-return (mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-return (tm)), tm-regs (tm-execute-return (tm)), tm-cc (tm-execute-return (tm)), tm-error (tm-execute-return (tm)), tm-svcflag (tm-execute-return (tm)), tm-svcid (tm-execute-return (tm)), tm-base (tm-execute-return (tm)), tm-limit (tm-execute-return (tm))))

Event: Disable tm-execute-return-commutes-with-mapup-address-space.

Theorem: tm-execute-set-clock-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-set-clock (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-set-clock (addr, tm)), tm-regs (tm-execute-set-clock (addr, tm)), tm-cc (tm-execute-set-clock (addr, tm)), tm-error (tm-execute-set-clock (addr, tm)), tm-svcflag (tm-execute-set-clock (addr, tm)), tm-svcid (tm-execute-set-clock (addr, tm)), tm-base (tm-execute-set-clock (addr, tm)), tm-limit (tm-execute-set-clock (addr, tm))))

Event: Disable tm-execute-set-clock-commutes-with-mapup-address-space.

Theorem: tm-execute-run-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-run (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-run (tm)), tm-regs (tm-execute-run (tm)), tm-cc (tm-execute-run (tm)), tm-error (tm-execute-run (tm)), tm-svcflag (tm-execute-run (tm)), tm-svcid (tm-execute-run (tm)), tm-base (tm-execute-run (tm)), tm-limit (tm-execute-run (tm))))

Event: Disable tm-execute-run-commutes-with-mapup-address-space.

Theorem: tm-execute-wait-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-wait (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-wait (tm)), tm-regs (tm-execute-wait (tm)), tm-cc (tm-execute-wait (tm)), tm-error (tm-execute-wait (tm)), tm-svcflag (tm-execute-wait (tm)), tm-svcid (tm-execute-wait (tm)), tm-base (tm-execute-wait (tm)), tm-limit (tm-execute-wait (tm))))

Event: Disable tm-execute-wait-commutes-with-mapup-address-space.

Theorem: tm-execute-test-iport-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-test-iport (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-test-iport (addr, tm)), tm-regs (tm-execute-test-iport (addr, tm)), tm-cc (tm-execute-test-iport (addr, tm)), tm-error (tm-execute-test-iport (addr, tm)), tm-svcflag (tm-execute-test-iport (addr, tm)), tm-svcid (tm-execute-test-iport (addr, tm)), tm-base (tm-execute-test-iport (addr, tm)), tm-limit (tm-execute-test-iport (addr, tm))))

Event: Disable tm-execute-test-iport-commutes-with-mapup-address-space.

Theorem: tm-execute-test-oport-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-test-oport (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-test-oport (addr, tm)), tm-regs (tm-execute-test-oport (addr, tm)), tm-cc (tm-execute-test-oport (addr, tm)), tm-error (tm-execute-test-oport (addr, tm)), tm-svcflag (tm-execute-test-oport (addr, tm)), tm-svcid (tm-execute-test-oport (addr, tm)), tm-base (tm-execute-test-oport (addr, tm)), tm-limit (tm-execute-test-oport (addr, tm))))

Event: Disable tm-execute-test-oport-commutes-with-mapup-address-space.

Theorem: tm-execute-start-output-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-start-output (addr1 ,

addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-start-output (addr1 , addr2 , tm)),

tm-regs (tm-execute-start-output (addr1 , addr2 , tm)),

tm-cc (tm-execute-start-output (addr1 , addr2 , tm)),

tm-error (tm-execute-start-output (addr1 , addr2 , tm)),

tm-svcflag (tm-execute-start-output (addr1 , addr2 , tm)),

tm-svcid (tm-execute-start-output (addr1 , addr2 , tm)),

tm-base (tm-execute-start-output (addr1 , addr2 , tm)),

tm-limit (tm-execute-start-output (addr1 , addr2 , tm))))

Event: Disable tm-execute-start-output-commutes-with-mapup-address-space.

Theorem: tm-execute-post-output-interrupt-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-post-output-interrupt (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-post-output-interrupt (addr,

tm)),

tm-regs (tm-execute-post-output-interrupt (addr, tm)), tm-cc (tm-execute-post-output-interrupt (addr,

tm)),

tm-error (tm-execute-post-output-interrupt (addr,

tm)),

tm-svcflag (tm-execute-post-output-interrupt (addr,

tm)),

tm-svcid (tm-execute-post-output-interrupt (addr,

tm)),

tm-base (tm-execute-post-output-interrupt (addr,

tm)),

tm-limit (tm-execute-post-output-interrupt (addr, tm))))

Event: Disable tm-execute-post-output-interrupt-commutes-with-mapup-address-space.

Theorem: tm-execute-svc-commutes-with-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm)) ∧ tm-good-address (addr, tm))) → (tm-execute-svc (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-svc (addr, tm)), tm-regs (tm-execute-svc (addr, tm)), tm-cc (tm-execute-svc (addr, tm)), tm-error (tm-execute-svc (addr, tm)), tm-svcflag (tm-execute-svc (addr, tm)), tm-svcid (tm-execute-svc (addr, tm)), tm-base (tm-execute-svc (addr, tm)), tm-limit (tm-execute-svc (addr, tm))))

Event: Disable tm-execute-svc-commutes-with-mapup-address-space.

Theorem: tm-execute-svc-return-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-execute-svc-return (addr,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-svc-return (addr, tm)), tm-regs (tm-execute-svc-return (addr, tm)), tm-cc (tm-execute-svc-return (addr, tm)), tm-error (tm-execute-svc-return (addr, tm)), tm-svcflag (tm-execute-svc-return (addr, tm)), tm-svcid (tm-execute-svc-return (addr, tm)), tm-base (tm-execute-svc-return (addr, tm)), tm-limit (tm-execute-svc-return (addr, tm))))

Event: Disable tm-execute-svc-return-commutes-with-mapup-address-space.

Definition: tm-execute-nullary2 (opcode, tm) = if opcode = '8 then tm-execute-run (tm)

elseif opcode = '4 then tm-execute-wait (tm)

else tm-set-error ('2, tm) endif

Definition: tm-execute-nullary1 (opcode, tm) = if opcode = '0 then tm-execute-return (tm)

else tm-execute-nullary2 (opcode, tm) endif

Theorem: tm-execute-nullary1-equals-tm-execute-nullary tm-execute-nullary1 (opcode, tm) = tm-execute-nullary (opcode, tm)

Event: Disable tm-execute-nullary1-equals-tm-execute-nullary.

Theorem: tm-execute-nullary2-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif

∧ (¬ tm-in-supervisor-mode (tm)))) → (tm-execute-nullary2 (opcode,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-nullary2 (opcode, tm)), tm-regs (tm-execute-nullary2 (opcode, tm)), tm-cc (tm-execute-nullary2 (opcode, tm)), tm-error (tm-execute-nullary2 (opcode, tm)), tm-svcflag (tm-execute-nullary2 (opcode, tm)), tm-svcid (tm-execute-nullary2 (opcode, tm)), tm-base (tm-execute-nullary2 (opcode, tm)), tm-limit (tm-execute-nullary2 (opcode, tm))))

Event: Disable tm-execute-nullary2-commutes-with-mapup-address-space.

Theorem: tm-execute-nullary1-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-nullary1 (opcode,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-nullary1 (opcode, tm)), tm-regs (tm-execute-nullary1 (opcode, tm)), tm-cc (tm-execute-nullary1 (opcode, tm)), tm-error (tm-execute-nullary1 (opcode, tm)), tm-svcflag (tm-execute-nullary1 (opcode, tm)), tm-svcid (tm-execute-nullary1 (opcode, tm)), tm-base (tm-execute-nullary1 (opcode, tm)), tm-limit (tm-execute-nullary1 (opcode, tm))))

Event: Disable tm-execute-nullary1-commutes-with-mapup-address-space.

Theorem: tm-execute-nullary-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-nullary (opcode,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-nullary (opcode, tm)), tm-regs (tm-execute-nullary (opcode, tm)), tm-cc (tm-execute-nullary (opcode, tm)), tm-error (tm-execute-nullary (opcode, tm)), tm-svcflag (tm-execute-nullary (opcode, tm)), tm-svcid (tm-execute-nullary (opcode, tm)), tm-base (tm-execute-nullary (opcode, tm)), tm-limit (tm-execute-nullary (opcode, tm))))

Event: Disable tm-execute-nullary-commutes-with-mapup-address-space.

Definition: tm-execute-unary8 (opcode, addr, tm) = if opcode = '50 then tm-execute-test-iport (addr, tm)

elseif opcode = '54 then tm-execute-test-oport (addr, tm)

else tm-set-error ('2, tm) endif

Definition: tm-execute-unary7 (opcode, addr, tm) = if opcode = '46 then tm-execute-svc-return (addr, tm)

elseif opcode = '38 then tm-execute-post-output-interrupt (addr, tm) else tm-execute-unary8 (opcode, addr, tm) endif

Definition: tm-execute-unary6 (opcode, addr, tm) = if opcode = '58 then tm-execute-set-clock (addr, tm)

elseif opcode = '42 then tm-execute-svc (addr, tm) else tm-execute-unary7 (opcode, addr, tm) endif

Definition: tm-execute-unary5 (opcode, addr, tm) = if opcode = '30 then tm-execute-load-limit (addr, tm)

elseif opcode = '34 then tm-execute-load-psw (addr, tm)

else tm-execute-unary6 (opcode, addr, tm) endif Definition: tm-execute-unary4 (opcode, addr, tm) = if opcode = '22 then tm-execute-incr (addr, tm)

elseif opcode = '26 then tm-execute-load-base (addr, tm)

else tm-execute-unary5 (opcode, addr, tm) endif

Definition: tm-execute-unary3 (opcode, addr, tm) = if opcode = '6 then tm-execute-branch-not-zero (addr, tm)

elseif opcode = '18 then tm-execute-decr (addr, tm) else tm-execute-unary4 (opcode, addr, tm) endif

Definition: tm-execute-unary2 (opcode, addr, tm) = if opcode = '10 then tm-execute-branch-on-zero (addr, tm)

elseif opcode = '14 then tm-execute-call (addr, tm) else tm-execute-unary3 (opcode, addr, tm) endif

Definition: tm-execute-unary1 (opcode, addr, tm) = if ¬ tm-good-address (addr, tm) then tm-set-error ('6, tm)

elseif opcode = '2 then tm-execute-branch (addr, tm)

else tm-execute-unary2 (opcode, addr, tm) endif

Theorem: tm-execute-unary1-equals-tm-execute-unary tm-execute-unary1 (opcode, addr, tm) = tm-execute-unary (opcode, addr, tm)

Event: Disable tm-execute-unary1-equals-tm-execute-unary.

Theorem: tm-execute-unary8-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

          then '*1*false

else '*1*true endif

∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary8 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary8 (opcode, addr, tm)),

tm-regs (tm-execute-unary8 (opcode, addr, tm)), tm-cc (tm-execute-unary8 (opcode, addr, tm)), tm-error (tm-execute-unary8 (opcode, addr, tm)), tm-svcflag (tm-execute-unary8 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary8 (opcode, addr, tm)), tm-base (tm-execute-unary8 (opcode, addr, tm)), tm-limit (tm-execute-unary8 (opcode, addr, tm))))

Event: Disable tm-execute-unary8-commutes-with-mapup-address-space.

Theorem: tm-execute-unary7-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary7 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary7 (opcode, addr, tm)),

tm-regs (tm-execute-unary7 (opcode, addr, tm)), tm-cc (tm-execute-unary7 (opcode, addr, tm)), tm-error (tm-execute-unary7 (opcode, addr, tm)), tm-svcflag (tm-execute-unary7 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary7 (opcode, addr, tm)), tm-base (tm-execute-unary7 (opcode, addr, tm)), tm-limit (tm-execute-unary7 (opcode, addr, tm))))

Event: Disable tm-execute-unary7-commutes-with-mapup-address-space.

Theorem: tm-execute-unary6-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary6 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary6 (opcode, addr, tm)),

tm-regs (tm-execute-unary6 (opcode, addr, tm)), tm-cc (tm-execute-unary6 (opcode, addr, tm)), tm-error (tm-execute-unary6 (opcode, addr, tm)), tm-svcflag (tm-execute-unary6 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary6 (opcode, addr, tm)), tm-base (tm-execute-unary6 (opcode, addr, tm)), tm-limit (tm-execute-unary6 (opcode, addr, tm))))

Event: Disable tm-execute-unary6-commutes-with-mapup-address-space.

Theorem: tm-execute-unary5-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif

∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary5 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary5 (opcode, addr, tm)),

tm-regs (tm-execute-unary5 (opcode, addr, tm)), tm-cc (tm-execute-unary5 (opcode, addr, tm)), tm-error (tm-execute-unary5 (opcode, addr, tm)), tm-svcflag (tm-execute-unary5 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary5 (opcode, addr, tm)), tm-base (tm-execute-unary5 (opcode, addr, tm)), tm-limit (tm-execute-unary5 (opcode, addr, tm))))

Event: Disable tm-execute-unary5-commutes-with-mapup-address-space.

Theorem: tm-execute-unary4-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary4 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary4 (opcode, addr, tm)),

tm-regs (tm-execute-unary4 (opcode, addr, tm)), tm-cc (tm-execute-unary4 (opcode, addr, tm)), tm-error (tm-execute-unary4 (opcode, addr, tm)), tm-svcflag (tm-execute-unary4 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary4 (opcode, addr, tm)), tm-base (tm-execute-unary4 (opcode, addr, tm)), tm-limit (tm-execute-unary4 (opcode, addr, tm))))

Event: Disable tm-execute-unary4-commutes-with-mapup-address-space.

Theorem: tm-execute-unary3-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary3 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary3 (opcode, addr, tm)),

tm-regs (tm-execute-unary3 (opcode, addr, tm)), tm-cc (tm-execute-unary3 (opcode, addr, tm)), tm-error (tm-execute-unary3 (opcode, addr, tm)), tm-svcflag (tm-execute-unary3 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary3 (opcode, addr, tm)), tm-base (tm-execute-unary3 (opcode, addr, tm)), tm-limit (tm-execute-unary3 (opcode, addr, tm))))

Event: Disable tm-execute-unary3-commutes-with-mapup-address-space.

Theorem: tm-execute-unary2-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr, tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm)))))

→ (tm-execute-unary2 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary2 (opcode, addr, tm)),

tm-regs (tm-execute-unary2 (opcode, addr, tm)), tm-cc (tm-execute-unary2 (opcode, addr, tm)), tm-error (tm-execute-unary2 (opcode, addr, tm)), tm-svcflag (tm-execute-unary2 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary2 (opcode, addr, tm)), tm-base (tm-execute-unary2 (opcode, addr, tm)), tm-limit (tm-execute-unary2 (opcode, addr, tm))))

Event: Disable tm-execute-unary2-commutes-with-mapup-address-space.

Theorem: tm-execute-unary1-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-unary1 (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary1 (opcode, addr, tm)),

tm-regs (tm-execute-unary1 (opcode, addr, tm)), tm-cc (tm-execute-unary1 (opcode, addr, tm)), tm-error (tm-execute-unary1 (opcode, addr, tm)), tm-svcflag (tm-execute-unary1 (opcode,

addr, tm)),

tm-svcid (tm-execute-unary1 (opcode, addr, tm)), tm-base (tm-execute-unary1 (opcode, addr, tm)), tm-limit (tm-execute-unary1 (opcode, addr, tm))))

Event: Disable tm-execute-unary1-commutes-with-mapup-address-space.

Theorem: tm-execute-unary-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-unary (opcode, addr, mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-unary (opcode, addr, tm)), tm-regs (tm-execute-unary (opcode, addr, tm)), tm-cc (tm-execute-unary (opcode, addr, tm)), tm-error (tm-execute-unary (opcode, addr, tm)), tm-svcflag (tm-execute-unary (opcode,

addr, tm)),

tm-svcid (tm-execute-unary (opcode, addr, tm)), tm-base (tm-execute-unary (opcode, addr, tm)), tm-limit (tm-execute-unary (opcode, addr, tm))))

Event: Disable tm-execute-unary-commutes-with-mapup-address-space.

Definition: tm-execute-binary6 (opcode, addr1 , addr2 , tm) = if opcode = '7 then tm-execute-incr-mod (addr1 , addr2 , tm)

else tm-set-error ('2, tm) endif

Definition: tm-execute-binary5 (opcode, addr1 , addr2 , tm) = if opcode = '15 then tm-execute-start-output (addr1 , addr2 , tm)

elseif opcode = '5 then tm-execute-decr-mod (addr1 , addr2 , tm) else tm-execute-binary6 (opcode, addr1 , addr2 , tm) endif

Definition: tm-execute-binary4 (opcode, addr1 , addr2 , tm) = if opcode = '11 then tm-execute-move (addr1 , addr2 , tm)

elseif opcode = '13 then tm-execute-multiply (addr1 , addr2 , tm) else tm-execute-binary5 (opcode, addr1 , addr2 , tm) endif

Definition: tm-execute-binary3 (opcode, addr1 , addr2 , tm) = if opcode = '3 then tm-execute-compare (addr1 , addr2 , tm)

elseif opcode = '9 then tm-execute-mod (addr1 , addr2 , tm) else tm-execute-binary4 (opcode, addr1 , addr2 , tm) endif

Definition: tm-execute-binary2 (opcode, addr1 , addr2 , tm) = if opcode = '1 then tm-execute-add (addr1 , addr2 , tm)

else tm-execute-binary3 (opcode, addr1 , addr2 , tm) endif

Definition: tm-execute-binary1 (opcode, addr1 , addr2 , tm) = if (¬ tm-good-address (addr1 , tm))

∨ (¬ tm-good-address (addr2 , tm)) then tm-set-error ('6, tm) else tm-execute-binary2 (opcode, addr1 , addr2 , tm) endif

Theorem: tm-execute-binary1-equals-tm-execute-binary tm-execute-binary1 (opcode, addr1 , addr2 , tm) = tm-execute-binary (opcode, addr1 , addr2 , tm)

Event: Disable tm-execute-binary1-equals-tm-execute-binary.

Theorem: tm-execute-binary6-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr1 , tm)

∧ (tm-good-address (addr2 , tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))))

→ (tm-execute-binary6 (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-svcflag (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary6 (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary6 (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary6-commutes-with-mapup-address-space.

Theorem: tm-execute-binary5-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr1 , tm)

∧ (tm-good-address (addr2 , tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))))

→ (tm-execute-binary5 (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary5 (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary5 (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary5 (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary5 (opcode, addr1 , addr2 ,

tm)),

tm-svcflag (tm-execute-binary5 (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary5 (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary5 (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary5 (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary5-commutes-with-mapup-address-space.

Theorem: tm-execute-binary4-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr1 , tm)

∧ (tm-good-address (addr2 , tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))))

→ (tm-execute-binary4 (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-svcflag (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary4 (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary4 (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary4-commutes-with-mapup-address-space.

Theorem: tm-execute-binary3-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr1 , tm)

∧ (tm-good-address (addr2 , tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))))

→ (tm-execute-binary3 (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-svcflag (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary3 (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary3 (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary3-commutes-with-mapup-address-space.

Theorem: tm-execute-binary2-commutes-with-mapup-address-space (good-tm (tm) ∧ (tm-good-address (addr1 , tm)

∧ (tm-good-address (addr2 , tm)

∧ (if '65536 < (tm-base (tm) + tm-limit (tm))

then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))))

→ (tm-execute-binary2 (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-svcflag (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary2 (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary2 (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary2-commutes-with-mapup-address-space.

Theorem: tm-execute-binary1-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-binary1 (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-svcflag (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary1 (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary1 (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary1-commutes-with-mapup-address-space.

Theorem: tm-execute-binary-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-binary (opcode, addr1 , addr2 , mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-binary (opcode, addr1 , addr2 , tm)),

tm-regs (tm-execute-binary (opcode, addr1 , addr2 , tm)),

tm-cc (tm-execute-binary (opcode, addr1 , addr2 , tm)),

tm-error (tm-execute-binary (opcode, addr1 , addr2 ,

tm)),

tm-svcflag (tm-execute-binary (opcode, addr1 , addr2 , tm)),

tm-svcid (tm-execute-binary (opcode, addr1 , addr2 , tm)),

tm-base (tm-execute-binary (opcode, addr1 , addr2 , tm)),

tm-limit (tm-execute-binary (opcode, addr1 , addr2 , tm))))

Event: Disable tm-execute-binary-commutes-with-mapup-address-space.

Theorem: tm-compute-address-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-compute-address (arg,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-compute-address (arg, tm))

Event: Disable tm-compute-address-mapup-address-space.

Definition: tm-execute-instruction2 (instruction, tm) = if length (instruction) = '3

then tm-execute-binary (tm-opcode (car (instruction)), tm-compute-address (tm-arg1 (instruction), tm), tm-compute-address (tm-arg2 (instruction), tm), tm)

else tm-set-error ('2, tm) endif Definition: tm-execute-instruction1 (instruction, tm) = if length (instruction) = '1

then tm-execute-nullary (tm-opcode (car (instruction)), tm) elseif length (instruction) = '2 then tm-execute-unary (tm-opcode (car (instruction)),

tm-compute-address (tm-arg1 (instruction), tm), tm)

else tm-execute-instruction2 (instruction, tm) endif

Theorem: tm-execute-instruction1-equals-tm-execute-instruction tm-execute-instruction1 (instruction, tm) = tm-execute-instruction (instruction, tm)

Event: Disable tm-execute-instruction1-equals-tm-execute-instruction.

Theorem: tm-execute-instruction2-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-instruction2 (instruction,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-instruction2 (instruction,

tm)),

tm-regs (tm-execute-instruction2 (instruction,

tm)),

tm-cc (tm-execute-instruction2 (instruction,

tm)),

tm-error (tm-execute-instruction2 (instruction,

tm)),

tm-svcflag (tm-execute-instruction2 (instruction,

tm)),

tm-svcid (tm-execute-instruction2 (instruction,

tm)),

tm-base (tm-execute-instruction2 (instruction, tm)), tm-limit (tm-execute-instruction2 (instruction,

tm))))

Event: Disable tm-execute-instruction2-commutes-with-mapup-address-space.

Theorem: tm-execute-instruction1-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-instruction1 (instruction,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-instruction1 (instruction,

tm)),

tm-regs (tm-execute-instruction1 (instruction,

tm)),

tm-cc (tm-execute-instruction1 (instruction,

tm)),

tm-error (tm-execute-instruction1 (instruction,

tm)),

tm-svcflag (tm-execute-instruction1 (instruction,

tm)),

tm-svcid (tm-execute-instruction1 (instruction,

tm)),

tm-base (tm-execute-instruction1 (instruction,

tm)),

tm-limit (tm-execute-instruction1 (instruction, tm))))

Event: Disable tm-execute-instruction1-commutes-with-mapup-address-space.

Theorem: tm-execute-instruction-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute-instruction (instruction,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute-instruction (instruction,

tm)),

tm-regs (tm-execute-instruction (instruction,

tm)),

tm-cc (tm-execute-instruction (instruction,

tm)),

tm-error (tm-execute-instruction (instruction,

tm)),

tm-svcflag (tm-execute-instruction (instruction,

tm)),

tm-svcid (tm-execute-instruction (instruction,

tm)),

tm-base (tm-execute-instruction (instruction,

tm)),

tm-limit (tm-execute-instruction (instruction, tm))))

Event: Disable tm-execute-instruction-commutes-with-mapup-address-space.

Theorem: tm-decrement-clock-commutes-with-mapup-address-space (good-tm (tm) ∧ (¬ tm-in-supervisor-mode (tm))) → (tm-decrement-clock (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-decrement-clock (tm)), tm-regs (tm-decrement-clock (tm)), tm-cc (tm-decrement-clock (tm)), tm-error (tm-decrement-clock (tm)), tm-svcflag (tm-decrement-clock (tm)), tm-svcid (tm-decrement-clock (tm)), tm-base (tm-decrement-clock (tm)), tm-limit (tm-decrement-clock (tm))))

Event: Disable tm-decrement-clock-commutes-with-mapup-address-space.

Theorem: tm-in-supervisor-mode-tm-decrement-clock tm-in-supervisor-mode (tm-decrement-clock (tm)) = tm-in-supervisor-mode (tm)

Event: Disable tm-in-supervisor-mode-tm-decrement-clock.

Theorem: tm-fetch-arg1-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (real-addr ('2, tm-incrn ('1, tm-pc (tm))), tm))) → (tm-fetch-arg1 (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-fetch-arg1 (tm))

Event: Disable tm-fetch-arg1-mapup-address-space.

Theorem: tm-fetch-arg2-mapup-address-space (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (real-addr ('2, tm-incrn ('2, tm-pc (tm))), tm))) → (tm-fetch-arg2 (mapup-address-space (tm-memory (tm),

tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-fetch-arg2 (tm))

Event: Disable tm-fetch-arg2-mapup-address-space.

Definition: tm-execute2 (opcode, tm) = if tm-unary-instructionp (opcode)

then tm-execute-instruction (cons (opcode,

cons (tm-fetch-arg1 (tm), 'nil)), tm-set-pc (tm-incrn ('2, tm-pc (tm)), tm))

elseif tm-good-address (real-addr ('2, tm-incrn ('2, tm-pc (tm))), tm) then tm-execute-instruction (cons (opcode,

cons (tm-fetch-arg1 (tm),

cons (tm-fetch-arg2 (tm), 'nil))),

tm-set-pc (tm-incrn ('3, tm-pc (tm)), tm))

else tm-set-error ('7, tm) endif

Definition: tm-execute1 (opcode, tm) = if tm-nullary-instructionp (opcode)

then tm-execute-instruction (cons (opcode, 'nil),

tm-set-pc (tm-incrn ('1, tm-pc (tm)), tm))

elseif tm-good-address (real-addr ('2, tm-incrn ('1, tm-pc (tm))), tm) then tm-execute2 (opcode, tm) else tm-set-error ('7, tm) endif

Theorem: tm-execute1-equals-tm-execute tm-execute1 (opcode, tm) = tm-execute (opcode, tm)

Event: Disable tm-execute1-equals-tm-execute.

Theorem: tm-execute2-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif

∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (real-addr ('2,

tm-incrn ('1, tm-pc (tm))),

tm))))

→ (tm-execute2 (instruction,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute2 (instruction, tm)), tm-regs (tm-execute2 (instruction, tm)), tm-cc (tm-execute2 (instruction, tm)), tm-error (tm-execute2 (instruction, tm)), tm-svcflag (tm-execute2 (instruction, tm)), tm-svcid (tm-execute2 (instruction, tm)), tm-base (tm-execute2 (instruction, tm)), tm-limit (tm-execute2 (instruction, tm))))

Event: Disable tm-execute2-commutes-with-mapup-address-space.

Theorem: tm-execute1-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute1 (instruction,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute1 (instruction, tm)), tm-regs (tm-execute1 (instruction, tm)), tm-cc (tm-execute1 (instruction, tm)), tm-error (tm-execute1 (instruction, tm)), tm-svcflag (tm-execute1 (instruction, tm)), tm-svcid (tm-execute1 (instruction, tm)), tm-base (tm-execute1 (instruction, tm)), tm-limit (tm-execute1 (instruction, tm))))

Event: Disable tm-execute1-commutes-with-mapup-address-space.

Theorem: tm-execute-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-execute (instruction,

mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-execute (instruction, tm)), tm-regs (tm-execute (instruction, tm)), tm-cc (tm-execute (instruction, tm)), tm-error (tm-execute (instruction, tm)), tm-svcflag (tm-execute (instruction, tm)), tm-svcid (tm-execute (instruction, tm)), tm-base (tm-execute (instruction, tm)), tm-limit (tm-execute (instruction, tm))))

Event: Disable tm-execute-commutes-with-mapup-address-space.

Theorem: tm-fetch-opcode-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ ((¬ tm-in-supervisor-mode (tm))

∧ tm-good-address (real-addr ('2, tm-pc (tm)), tm))))

→ (tm-fetch-opcode (mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= tm-fetch-opcode (tm))

Event: Disable tm-fetch-opcode-mapup-address-space.

Theorem: tm-fetch-execute-commutes-with-mapup-address-space (good-tm (tm) ∧ (if '65536 < (tm-base (tm) + tm-limit (tm)) then '*1*false

else '*1*true endif ∧ (¬ tm-in-supervisor-mode (tm))))

→ (tm-fetch-execute (mapup-address-space (tm-memory (tm), tm-regs (tm), tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm), tm-base (tm), tm-limit (tm)))

= mapup-address-space (tm-memory (tm-fetch-execute (tm)), tm-regs (tm-fetch-execute (tm)), tm-cc (tm-fetch-execute (tm)), tm-error (tm-fetch-execute (tm)), tm-svcflag (tm-fetch-execute (tm)), tm-svcid (tm-fetch-execute (tm)), tm-base (tm-fetch-execute (tm)), tm-limit (tm-fetch-execute (tm))))

Event: Disable tm-fetch-execute-commutes-with-mapup-address-space.

Definition: deq-ith-buffer (id, buffers) = putnth (deq (getnth (id, buffers)), id, buffers)

Definition: enq-ith-buffer (item, id, buffers) = putnth (enq (item, getnth (id, buffers)), id, buffers)

Definition: qreplace-ith-buffer (item, id, buffers) = putnth (qreplace (item, getnth (id, buffers)), id, buffers)

Event: Add the shell task, with recognizer function symbol task-shellp and 2 accessors: task-pstate, with type restriction (none-of) and default value zero; task-channels, with type restriction (none-of) and default value zero.

Event: Let us define the theory task-shell to consist of the following events: task.

Definition: task-ibuffers (task) = car (task-channels (task))

Definition: task-obuffers (task) = car (cdr (task-channels (task)))

Definition: task-mbuffers (task) = car (cdr (cdr (task-channels (task))))

Definition: task-ibuffer-capacity = '4

Definition: task-obuffer-capacity = '4 Definition: task-mbuffer-capacity = '4 Definition: os-svc-send-id = '0 Definition: os-svc-receive-id = '1 Definition: os-svc-tyo-id = '2 Definition: os-svc-tyi-id = '3 Definition: task-send-instructionp (task) = ((tm-svcid (task-pstate (task)) mod '4) = '0) Definition: task-receive-instructionp (task) = ((tm-svcid (task-pstate (task)) mod '4) = '1) Definition: task-tyo-instructionp (task) = ((tm-svcid (task-pstate (task)) mod '4) = '2) Definition: task-tyi-instructionp (task) = ((tm-svcid (task-pstate (task)) mod '4) = '3) Definition: task-update-control (pstate) = tm-set-svcflag ('0, pstate) Definition: task-communicationp (task) = tm-svc-interruptp (task-pstate (task)) Definition: os-srcid (task, max) = (tm-r2 (task) mod max) Definition: os-destid (task, max) = (tm-r2 (task) mod max) Definition: os-idevid (task, max) = (tm-r2 (task) mod max) Definition: os-odevid (task, max) = (tm-r2 (task) mod max) Definition: os-message (task) = tm-r3 (task) Definition: os-store-message (msg, task) = tm-store (msg, '(1 3), task) Definition: task-srcid (task) = os-srcid (task-pstate (task), length (task-mbuffers (task)))

Definition: task-destid (task) = os-destid (task-pstate (task), length (task-mbuffers (task)))

Definition: task-idevid (task) = os-idevid (task-pstate (task), length (task-ibuffers (task)))

Definition: task-odevid (task) = os-odevid (task-pstate (task), length (task-ibuffers (task)))

Definition: task-message (task) = os-message (task-pstate (task))

Definition: task-store-message (msg, pstate) = os-store-message (msg, pstate)

Definition: task-fetch-execute (pstate) = tm-fetch-execute (pstate)

Definition: task-execute-send (msg, srcid, destid, task) = if qfullp2 (srcid, destid, task-mbuffers (task), '4) then task

else task (task-update-control (task-pstate (task)), cons (task-ibuffers (task),

cons (task-obuffers (task), cons (enq2 (msg,

srcid, destid, task-mbuffers (task)),

'nil)))) endif

Definition: task-execute-receive (srcid, destid, task) = if qemptyp2 (srcid, destid, task-mbuffers (task)) then task

else task (task-update-control (task-store-message (qfirst2 (srcid, destid, task-mbuffers (task)),

task-pstate (task))),

cons (task-ibuffers (task),

cons (task-obuffers (task),

cons (deq2 (srcid, destid, task-mbuffers (task)), 'nil)))) endif

Definition: task-execute-output (char, id, task) = if qfullp (getnth (id, task-obuffers (task)), '4) then task

else task (task-update-control (task-pstate (task)), cons (task-ibuffers (task),

cons (enq-ith-buffer (char, id, task-obuffers (task)), cons (task-mbuffers (task), 'nil)))) endif

Definition: task-execute-input (id, task) = if qemptyp (getnth (id, task-ibuffers (task))) then task

else task (task-update-control (task-store-message (qfirst (getnth (id,

task-ibuffers (task))),

task-pstate (task))),

cons (deq-ith-buffer (id, task-ibuffers (task)),

cons (task-obuffers (task), cons (task-mbuffers (task), 'nil)))) endif

Definition: task-communication-step (task, i) = if task-send-instructionp (task)

then task-execute-send (task-message (task), i, task-destid (task), task) elseif task-receive-instructionp (task) then task-execute-receive (task-srcid (task), i, task) elseif task-tyo-instructionp (task) then task-execute-output (task-message (task), i, task) else task-execute-input (i, task) endif

Definition: task-private-step (task) = task (task-fetch-execute (task-pstate (task)), task-channels (task))

Definition: task-step (task, i) = if task-communicationp (task) then task-communication-step (task, i)

else task-private-step (task) endif

Definition: task-update-channels (task, channels) = task (task-pstate (task), channels)

Definition: task-activep (x) = (x = '*1*true)

Definition: task-processor (task, i, oracle) = if listp (oracle)

then if task-activep (car (oracle)) then task-processor (task-step (task, i), i, cdr (oracle)) else task-processor (task-update-channels (task, car (oracle)),

i,

cdr (oracle)) endif

else task endif

Theorem: finite-numberp-os-message good-address-space (machine, memlength) → finite-numberp (os-message (machine), '65536)

Event: Disable finite-numberp-os-message.

Theorem: good-address-space-os-store-message (good-address-space (tm, memlength) ∧ finite-numberp (msg, '65536)) → good-address-space (os-store-message (msg, tm), memlength)

Event: Disable good-address-space-os-store-message.

Theorem: good-address-space-os-store-message1 (good-address-space (task, length (tm-memory (task))) ∧ finite-numberp (msg, '65536)) → good-address-space (os-store-message (msg, task), length (tm-memory (task)))

Event: Disable good-address-space-os-store-message1.

Theorem: length-tm-memory-os-store-message length (tm-memory (os-store-message (msg, task))) = length (tm-memory (task))

Event: Disable length-tm-memory-os-store-message.

Definition: good-task-buffer (buffer, capacity) = (plistp (buffer)

∧ ((length (buffer) < (1 + capacity)) ∧ finite-number-listp (buffer, '65536)))

Definition: good-task-buffer-list (l, capacity) = if listp (l)

then good-task-buffer (car (l), capacity)

∧ good-task-buffer-list (cdr (l), capacity) else l = 'nil endif Definition: good-task-buffer-table (l, length, capacity) = if listp (l)

then plistp (car (l))

∧ ((length (car (l)) = length)

∧ (good-task-buffer-list (car (l), capacity) ∧ good-task-buffer-table (cdr (l),

length, capacity)))

else l = 'nil endif

Definition: good-task (task, ilength, olength, mlength) = (task-shellp (task)

∧ (good-address-space (task-pstate (task),

length (tm-memory (task-pstate (task))))

∧ ((length (task-ibuffers (task)) = ilength)

∧ (good-task-buffer-list (task-ibuffers (task),

                                   '4)

∧ ((length (task-obuffers (task)) = olength) ∧ (good-task-buffer-list (task-obuffers (task),

                                           '4)

∧ ((length (task-mbuffers (task)) = mlength) ∧ good-task-buffer-table (task-mbuffers (task),

mlength, '4))))))))

Theorem: good-task-buffer-properties good-task-buffer (buffer, capacity) → (plistp (buffer)

∧ ((length (buffer) < (1 + capacity)) ∧ finite-number-listp (buffer, '65536)))

Event: Disable good-task-buffer-properties.

Theorem: good-task-buffer-getnth (good-task-buffer-list (l, capacity) ∧ (i < length (l))) → good-task-buffer (getnth (i, l), capacity)

Event: Disable good-task-buffer-getnth.

Theorem: plistp-good-task-buffer-list good-task-buffer-list (l, capacity) → plistp (l)

Event: Disable plistp-good-task-buffer-list.

Theorem: good-task-buffer-list-putnth (good-task-buffer-list (l, capacity) ∧ (plistp (buffer)

∧ ((length (buffer) < (1 + capacity))

∧ finite-number-listp (buffer, '65536))))

→ good-task-buffer-list (putnth (buffer, i, l), capacity)

Event: Disable good-task-buffer-list-putnth.

Theorem: good-task-buffer-list-getnth (good-task-buffer-table (l, length, capacity) ∧ (i < length (l))) → (plistp (getnth (i, l))

∧ ((length (getnth (i, l)) = length) ∧ good-task-buffer-list (getnth (i, l), capacity)))

Event: Disable good-task-buffer-list-getnth.

Theorem: good-task-buffer-getnth2 (good-task-buffer-table (l, length, capacity) ∧ ((i < length (l)) ∧ (j < length))) → good-task-buffer (getnth2 (i, j , l), capacity)

Event: Disable good-task-buffer-getnth2.

Theorem: good-task-buffer-table-putnth (good-task-buffer-table (l, length, capacity) ∧ (plistp (x)

∧ ((length (x) = length)

∧ good-task-buffer-list (x, capacity))))

→ good-task-buffer-table (putnth (x, i, l), length, capacity)

Event: Disable good-task-buffer-table-putnth.

Theorem: good-task-buffer-table-putnth2 (good-task-buffer-table (l, length, capacity) ∧ ((i < length (l))

∧ (plistp (buffer)

∧ ((length (buffer) < (1 + capacity))

∧ finite-number-listp (buffer, '65536)))))

→ good-task-buffer-table (putnth2 (buffer, i, j , l), length, capacity)

Event: Disable good-task-buffer-table-putnth2.

Theorem: plistp-good-task-buffer-table good-task-buffer-table (l, length, capacity) → plistp (l)

Event: Disable plistp-good-task-buffer-table.

Event: Add the shell ak, with recognizer function symbol ak-shellp and 10 accessors: ak-pstates, with type restriction (none-of) and default value zero; ak-ibuffers, with type restriction (none-of) and default value zero; ak-obuffers, with type restriction (none-of) and default value zero; ak-mbuffers, with type restriction (none-of) and default value zero; ak-readyq, with type restriction (none-of) and default value zero; ak-status, with type restriction (none-of) and default value zero; ak-rwstate, with type restriction (none-of) and default value zero; ak-clock, with type restriction (none-of) and default value zero; ak-iports, with type restriction (none-of) and default value zero; ak-oports, with type restriction (none-of) and default value zero.

Event: Let us define the theory ak-shell to consist of the following events: ak.

Definition: ak-taskidlub = '16

Definition: ak-time-slice = '1000

Definition: ak-taskid (ak) = qfirst (ak-readyq (ak))

Definition: ak-send-instructionp (ak) = ((tm-svcid (getnth (ak-taskid (ak), ak-pstates (ak))) mod '4) = '0)

Definition: ak-receive-instructionp (ak) = ((tm-svcid (getnth (ak-taskid (ak), ak-pstates (ak))) mod '4) = '1)

Definition: ak-tyo-instructionp (ak) = ((tm-svcid (getnth (ak-taskid (ak), ak-pstates (ak))) mod '4) = '2)

Definition: ak-tyi-instructionp (ak) = ((tm-svcid (getnth (ak-taskid (ak), ak-pstates (ak))) mod '4) = '3)

Definition: ak-update-control (id, pstates) = putnth (tm-set-svcflag ('0, getnth (id, pstates)), id, pstates)

Definition: ak-communicationp (ak) = tm-svc-interruptp (getnth (ak-taskid (ak), ak-pstates (ak)))

Definition: ak-errorp (ak) = tm-errorp (getnth (ak-taskid (ak), ak-pstates (ak)))

Definition: ak-svc-interruptp (ak) = tm-svc-interruptp (getnth (ak-taskid (ak), ak-pstates (ak)))

Definition: ak-destid (ak) = os-destid (getnth (ak-taskid (ak), ak-pstates (ak)), '16)

Definition: ak-srcid (ak) = os-srcid (getnth (ak-taskid (ak), ak-pstates (ak)), '16)

Definition: ak-idevid (ak) = os-idevid (getnth (ak-taskid (ak), ak-pstates (ak)), '16)

Definition: ak-odevid (ak) = os-odevid (getnth (ak-taskid (ak), ak-pstates (ak)), '16)

Definition: ak-message (ak) = os-message (getnth (ak-taskid (ak), ak-pstates (ak)))

Definition: ak-store-message (msg, taskid, pstates) = putnth (os-store-message (msg, getnth (taskid, pstates)), taskid, pstates)

Definition: ak-fetch-execute (id, pstates) = putnth (tm-fetch-execute (getnth (id, pstates)), id, pstates)

Definition: ak-oport-idlep (id, oports) = tm-oport-idlep (id, oports)

Definition: ak-post-output-interrupt (id, oports) = tm-post-output-interrupt (id, oports)

Definition: ak-clear-input-interrupt (id, iports) = tm-clear-input-interrupt (id, iports)

Definition: ak-clear-output-interrupt (id, oports) = tm-clear-output-interrupt (id, oports)

Definition: ak-start-output (char, id, oports) = tm-start-output (char, id, oports) Definition: ak-input-interruptp (ak) = tm-some-input-interruptp (ak-iports (ak)) Definition: ak-output-interruptp (ak) = tm-some-output-interruptp (ak-oports (ak)) Definition: ak-interrupting-input-port (iports) = tm-interrupting-input-port (iports) Definition: ak-interrupting-output-port (oports) = tm-interrupting-output-port (oports) Definition: ak-status-flag-field = '0 Definition: ak-status-taskid-field = '1 Definition: ak-ready-status = '0 Definition: ak-error-status = '1 Definition: ak-send-status = '2 Definition: ak-receive-status = '3 Definition: ak-output-status = '4 Definition: ak-input-status = '5 Definition: ak-status-lub = '6 Definition: ak-status-length = '2 Definition: ak-ready-statusp (taskid, ak) = (getnth ('0, getnth (taskid, ak-status (ak))) = '0) Definition: ak-waiting-to-sendp (srcid, destid, ak) = ((getnth ('0, getnth (srcid, ak-status (ak))) = '2)

∧ (getnth ('1, getnth (srcid, ak-status (ak))) = destid)) Definition: ak-waiting-to-receivep (srcid, destid, ak) = ((getnth ('0, getnth (destid, ak-status (ak))) = '3)

∧ (getnth ('1, getnth (destid, ak-status (ak))) = srcid))

Definition: ak-waiting-to-outputp (id, ak) = (getnth ('0, getnth (id, ak-status (ak))) = '4)

Definition: ak-waiting-to-inputp (id, ak) = (getnth ('0, getnth (id, ak-status (ak))) = '5)

Definition: ak-wait-state = '1

Definition: ak-run-state = '0

Definition: ak-waiting (ak) = (ak-rwstate (ak) = '1)

Definition: ak-dispatcher (ak) = ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), ak-readyq (ak), ak-status (ak), if qemptyp (ak-readyq (ak)) then '1 else '0 endif, if qemptyp (ak-readyq (ak)) then ak-clock (ak) else '1000 endif, ak-iports (ak), ak-oports (ak))

Definition: ak-clock-interrupt-handler (ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), enq (ak-taskid (ak), deq (ak-readyq (ak))), ak-status (ak), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak)))

Definition: ak-error-handler (ak) = ak-dispatcher (ak (ak-pstates (ak), ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), deq (ak-readyq (ak)), putnth ('(1 0), ak-taskid (ak), ak-status (ak)), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak)))

Definition: ak-block-send (srcid, destid, ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), deq (ak-readyq (ak)), putnth (cons ('2, cons (destid, 'nil)),

srcid,

ak-status (ak)), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak)))

Definition: ak-execute-send-to-buffer (msg, srcid, destid, ak) = ak (ak-update-control (srcid, ak-pstates (ak)),

ak-ibuffers (ak), ak-obuffers (ak), enq2 (msg, srcid, destid, ak-mbuffers (ak)), if ak-waiting-to-receivep (srcid, destid, ak) then enq (destid, ak-readyq (ak)) else ak-readyq (ak) endif, if ak-waiting-to-receivep (srcid, destid, ak) then putnth ('(0 0), destid, ak-status (ak)) else ak-status (ak) endif, ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak))

Definition: ak-execute-send (msg, srcid, destid, ak) = if qfullp2 (srcid, destid, ak-mbuffers (ak), '4) then ak-block-send (srcid, destid, ak) else ak-execute-send-to-buffer (msg, srcid, destid, ak) endif

Definition: ak-block-receive (srcid, destid, ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), deq (ak-readyq (ak)), putnth (cons ('3, cons (srcid, 'nil)),

destid,

ak-status (ak)), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak)))

Definition: ak-execute-receive-from-buffer (srcid, destid, ak) = ak (ak-update-control (destid,

ak-store-message (qfirst2 (srcid, destid, ak-mbuffers (ak)),

destid,

ak-pstates (ak))),

ak-ibuffers (ak), ak-obuffers (ak), deq2 (srcid, destid, ak-mbuffers (ak)), if ak-waiting-to-sendp (srcid, destid, ak) then enq (srcid, ak-readyq (ak)) else ak-readyq (ak) endif, if ak-waiting-to-sendp (srcid, destid, ak) then putnth ('(0 0), srcid, ak-status (ak)) else ak-status (ak) endif, ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak))

Definition: ak-execute-receive (srcid, destid, ak) = if qemptyp2 (srcid, destid, ak-mbuffers (ak))

then ak-block-receive (srcid, destid, ak) else ak-execute-receive-from-buffer (srcid, destid, ak) endif Definition: ak-block-output (id, ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), deq (ak-readyq (ak)), putnth ('(4 0), id, ak-status (ak)), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak)))

Definition: ak-execute-output-to-buffer (char, id, ak) = ak (ak-update-control (id, ak-pstates (ak)),

ak-ibuffers (ak), enq-ith-buffer (char, id, ak-obuffers (ak)), ak-mbuffers (ak), ak-readyq (ak), ak-status (ak), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), if ak-oport-idlep (id, ak-oports (ak)) then ak-post-output-interrupt (id, ak-oports (ak)) else ak-oports (ak) endif)

Definition: ak-execute-output (char, id, ak) = if qfullp (getnth (id, ak-obuffers (ak)), '4) then ak-block-output (id, ak)

else ak-execute-output-to-buffer (char, id, ak) endif

Definition: ak-block-input (id, ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), deq (ak-readyq (ak)), putnth ('(5 0), id, ak-status (ak)), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak)))

Definition: ak-execute-input-from-buffer (id, ak) = ak (ak-update-control (id,

ak-store-message (qfirst (getnth (id,

ak-ibuffers (ak))),

id,

ak-pstates (ak))),

putnth (deq (getnth (id, ak-ibuffers (ak))), id, ak-ibuffers (ak)), ak-obuffers (ak), ak-mbuffers (ak), ak-readyq (ak), ak-status (ak), ak-rwstate (ak), ak-clock (ak), ak-iports (ak), ak-oports (ak))

Definition: ak-execute-input (id, ak) = if qemptyp (getnth (id, ak-ibuffers (ak))) then ak-block-input (id, ak)

else ak-execute-input-from-buffer (id, ak) endif

Definition: ak-svc-handler (ak) = if ak-send-instructionp (ak)

then ak-execute-send (ak-message (ak), ak-taskid (ak), ak-destid (ak), ak) elseif ak-receive-instructionp (ak) then ak-execute-receive (ak-srcid (ak), ak-taskid (ak), ak) elseif ak-tyo-instructionp (ak) then ak-execute-output (ak-message (ak), ak-taskid (ak), ak) else ak-execute-input (ak-taskid (ak), ak) endif

Definition: ak-private-step (ak) = ak (ak-fetch-execute (ak-taskid (ak), ak-pstates (ak)),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), ak-readyq (ak), ak-status (ak), ak-rwstate (ak), ak-clock (ak) − 1, ak-iports (ak), ak-oports (ak))

Definition: ak-update-ibuffer (id, ak) = if qfullp (getnth (id, ak-ibuffers (ak)), '4)

then qreplace-ith-buffer (tm-overflow-char (tm-ichar (getnth (id,

ak-iports (ak)))),

id,

ak-ibuffers (ak))

elseif tm-iport-errorp (id, ak-iports (ak)) then enq-ith-buffer (tm-overflow-char (tm-ichar (getnth (id, ak-iports (ak)))),

id,

ak-ibuffers (ak))

else enq-ith-buffer (tm-ichar (getnth (id, ak-iports (ak))), id, ak-ibuffers (ak)) endif

Definition: ak-waiting-input-interrupt-handler (id, ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-update-ibuffer (id, ak), ak-obuffers (ak), ak-mbuffers (ak), if ak-waiting-to-inputp (id, ak) then enq (id, ak-readyq (ak)) else ak-readyq (ak) endif, if ak-waiting-to-inputp (id, ak) then putnth ('(0 0), id, ak-status (ak)) else ak-status (ak) endif, ak-rwstate (ak), ak-clock (ak), ak-clear-input-interrupt (id, ak-iports (ak)), ak-oports (ak)))

Definition: ak-running-input-interrupt-handler (id, ak) = ak (ak-pstates (ak),

ak-update-ibuffer (id, ak), ak-obuffers (ak), ak-mbuffers (ak), if ak-waiting-to-inputp (id, ak) then enq (id, ak-readyq (ak)) else ak-readyq (ak) endif, if ak-waiting-to-inputp (id, ak) then putnth ('(0 0), id, ak-status (ak)) else ak-status (ak) endif, ak-rwstate (ak), ak-clock (ak), ak-clear-input-interrupt (id, ak-iports (ak)), ak-oports (ak))

Definition: ak-input-interrupt-handler (id, ak) = if ak-waiting (ak) then ak-waiting-input-interrupt-handler (id, ak)

else ak-running-input-interrupt-handler (id, ak) endif

Definition: ak-waiting-output-interrupt-handler (id, ak) = ak-dispatcher (ak (ak-pstates (ak),

ak-ibuffers (ak), if qemptyp (getnth (id, ak-obuffers (ak))) then ak-obuffers (ak) else deq-ith-buffer (id, ak-obuffers (ak)) endif, ak-mbuffers (ak), if ak-waiting-to-outputp (id, ak) then enq (id, ak-readyq (ak)) else ak-readyq (ak) endif, if ak-waiting-to-outputp (id, ak) then putnth ('(0 0), id, ak-status (ak)) else ak-status (ak) endif, ak-rwstate (ak), ak-clock (ak), ak-iports (ak), if qemptyp (getnth (id, ak-obuffers (ak))) then ak-clear-output-interrupt (id, ak-oports (ak)) else ak-start-output (qfirst (getnth (id,

ak-obuffers (ak))),

id,

ak-oports (ak)) endif))

Definition: ak-running-output-interrupt-handler (id, ak) = ak (ak-pstates (ak),

ak-ibuffers (ak), if qemptyp (getnth (id, ak-obuffers (ak))) then ak-obuffers (ak) else deq-ith-buffer (id, ak-obuffers (ak)) endif, ak-mbuffers (ak), if ak-waiting-to-outputp (id, ak) then enq (id, ak-readyq (ak)) else ak-readyq (ak) endif, if ak-waiting-to-outputp (id, ak) then putnth ('(0 0), id, ak-status (ak)) else ak-status (ak) endif, ak-rwstate (ak), ak-clock (ak), ak-iports (ak), if qemptyp (getnth (id, ak-obuffers (ak))) then ak-clear-output-interrupt (id, ak-oports (ak)) else ak-start-output (qfirst (getnth (id, ak-obuffers (ak))),

id,

ak-oports (ak)) endif)

Definition: ak-output-interrupt-handler (id, ak) = if ak-waiting (ak) then ak-waiting-output-interrupt-handler (id, ak)

else ak-running-output-interrupt-handler (id, ak) endif

Definition: ak-clock-interruptp (ak) = (ak-clock (ak) ≃ 0)

Definition: ak-step (ak) = if ak-input-interruptp (ak)

then ak-input-interrupt-handler (ak-interrupting-input-port (ak-iports (ak)),

ak)

elseif ak-output-interruptp (ak) then ak-output-interrupt-handler (ak-interrupting-output-port (ak-oports (ak)),

ak)

elseif ak-waiting (ak) then ak elseif ak-errorp (ak) then ak-error-handler (ak) elseif ak-clock-interruptp (ak) then ak-clock-interrupt-handler (ak) elseif ak-svc-interruptp (ak) then ak-svc-handler (ak) else ak-private-step (ak) endif

Definition: ak-post-interrupt (interrupt, ak) = ak (ak-pstates (ak),

ak-ibuffers (ak), ak-obuffers (ak), ak-mbuffers (ak), ak-readyq (ak), ak-status (ak), ak-rwstate (ak), ak-clock (ak), if tm-device-input-eventp (interrupt) then tm-post-input-interrupt (tm-idatum (interrupt) mod '256,

tm-idevid (interrupt) mod '16, ak-iports (ak))

else ak-iports (ak) endif, if tm-device-output-eventp (interrupt) then tm-post-output-interrupt (tm-odevid (interrupt) mod '16,

ak-oports (ak))

else ak-oports (ak) endif)

Definition: ak-processor (ak, oracle) = if listp (oracle)

then ak-processor (ak-step (ak-post-interrupt (car (oracle), ak)),

cdr (oracle))

else ak endif

Theorem: good-tm-iport-array-putnth1 (good-tm-iport-array (l) ∧ (tm-iportp (iport)

∧ (finite-numberp (tm-iinterrupt-flag (iport), '2)

∧ (finite-numberp (tm-ierror-flag (iport), '2)

∧ finite-numberp (tm-ichar (iport), '256)))))

→ good-tm-iport-array (putnth (iport, n, l))

Event: Disable good-tm-iport-array-putnth1.

Theorem: good-tm-oport-array-putnth1 (good-tm-oport-array (l) ∧ (tm-oportp (oport)

∧ (finite-numberp (tm-ointerrupt-flag (oport), '2)

∧ (finite-numberp (tm-obusy-flag (oport), '2)

∧ finite-numberp (tm-ochar (oport), '256)))))

→ good-tm-oport-array (putnth (oport, n, l))

Event: Disable good-tm-oport-array-putnth1.

Definition: good-address-space-list (l) = if listp (l)

then good-address-space (car (l), length (tm-memory (car (l))))

∧ good-address-space-list (cdr (l)) else l = 'nil endif

Theorem: plistp-good-address-space-list good-address-space-list (l) → plistp (l)

Event: Disable plistp-good-address-space-list.

Theorem: good-address-space-getnth (good-address-space-list (l) ∧ (i < length (l))) → good-address-space (getnth (i, l), length (tm-memory (getnth (i, l))))

Event: Disable good-address-space-getnth.

Theorem: good-address-space-list-putnth (good-address-space-list (l) ∧ good-address-space (task, length (tm-memory (task)))) → good-address-space-list (putnth (task, i, l))

Event: Disable good-address-space-list-putnth.

Definition: good-status (task-status) = (plistp (task-status)

∧ ((length (task-status) = '2)

∧ (finite-numberp (getnth ('0, task-status), '6) ∧ finite-numberp (getnth ('1, task-status), '16))))

Definition: good-status-list (status) = if listp (status)

then good-status (car (status)) ∧ good-status-list (cdr (status))

else status = 'nil endif

Theorem: plistp-good-status-list good-status-list (l) → plistp (l)

Event: Disable plistp-good-status-list.

Theorem: good-status-getnth (good-status-list (l) ∧ (i < length (l))) → good-status (getnth (i, l))

Event: Disable good-status-getnth.

Theorem: good-status-list-putnth (good-status-list (l) ∧ (plistp (status)

∧ ((length (status) = '2)

∧ (finite-numberp (getnth ('0, status), '6)

∧ finite-numberp (getnth ('1, status), '16)))))

→ good-status-list (putnth (status, i, l))

Event: Disable good-status-list-putnth.

Event: Let us define the theory good-ak-construction to consist of the following events: good-task-buffer-table-putnth2, good-task-buffer-table-putnth, good-task-buffer-getnth2, good-task-buffer-list-getnth, good-task-buffer-list-putnth, plistp-good-task-buffer-list, good-task-buffer-getnth, good-status-list-putnth, goodstatus-getnth, plistp-good-status-list, good-tm-iport-getnth, good-tm-oport-getnth, good-tm-iport-array-putnth1, good-tm-oport-array-putnth1, good-address-space-getnth, good-address-space-list-putnth, plistp-good-address-space-list, a-finite-number-is-lessp-than-its-lub, length-putnth, length-putnth2, plistp-putnth, plistpputnth2.

Definition: status-flag-readyp (task-status) = (getnth ('0, task-status) = '0)

Definition: index-ready-set (n, status) = if listp (status)

then if status-flag-readyp (car (status)) then cons (fix (n), index-ready-set (1 + n, cdr (status))) else index-ready-set (1 + n, cdr (status)) endif

else 'nil endif

Definition: ak-ready-set (ak) = index-ready-set ('0, ak-status (ak))

(DEFN GOOD-AK
 (AK)
 (AND
  (AK-SHELLP AK)
  (AND
   (EQUAL (LENGTH (AK-PSTATES AK)) '16)
   (AND
    (GOOD-ADDRESS-SPACE-LIST (AK-PSTATES AK))
    (AND
     (EQUAL (LENGTH (AK-IBUFFERS AK)) '16)
     (AND
      (GOOD-TASK-BUFFER-LIST (AK-IBUFFERS AK)
                             '4)
      (AND
       (EQUAL (LENGTH (AK-OBUFFERS AK)) '16)
       (AND

(GOOD-TASK-BUFFER-LIST (AK-OBUFFERS AK)
'4)
(AND
(EQUAL (LENGTH (AK-MBUFFERS AK)) '16)
(AND
(GOOD-TASK-BUFFER-TABLE (AK-MBUFFERS AK)
'16
'4)
(AND
(PLISTP (AK-READYQ AK))
(AND
(LESSP (LENGTH (AK-READYQ AK)) '17)
(AND
(FINITE-NUMBER-LISTP (AK-READYQ AK)
'16)
(AND
(EQUAL (LENGTH (AK-STATUS AK)) '16)
(AND
(GOOD-STATUS-LIST (AK-STATUS AK))
(AND
(FINITE-NUMBERP (AK-RWSTATE AK) '2)
(AND
(FINITE-NUMBERP (AK-CLOCK AK) '65536)
(AND
(PLISTP (AK-IPORTS AK))
(AND
(EQUAL (LENGTH (AK-IPORTS AK)) '16)
(AND
(GOOD-TM-IPORT-ARRAY (AK-IPORTS AK))
(AND
(PLISTP (AK-OPORTS AK))
(AND
(EQUAL (LENGTH (AK-OPORTS AK)) '16)
(AND
(GOOD-TM-OPORT-ARRAY (AK-OPORTS AK))
(AND
(PERMUTATION (AK-READYQ AK)
     (AK-READY-SET AK))
(IFF (AK-WAITING AK)
(QEMPTYP (AK-READYQ AK))))))))))))))))))))))))))
NIL)

Theorem: ak-shellp-ak good-ak (ak) → ak-shellp (ak)

Event: Disable ak-shellp-ak.

Theorem: length-ak-pstates good-ak (ak) → (length (ak-pstates (ak)) = '16)

Event: Disable length-ak-pstates.

Theorem: good-address-space-list-ak-pstates good-ak (ak) → good-address-space-list (ak-pstates (ak))

Event: Disable good-address-space-list-ak-pstates.

Theorem: good-address-space-getnth-from-ak (good-ak (ak) ∧ (i < '16)) → good-address-space (getnth (i, ak-pstates (ak)),

length (tm-memory (getnth (i, ak-pstates (ak)))))

Event: Disable good-address-space-getnth-from-ak.

Theorem: length-ak-ibuffers good-ak (ak) → (length (ak-ibuffers (ak)) = '16)

Event: Disable length-ak-ibuffers.

Theorem: good-task-buffer-list-ak-ibuffers good-ak (ak) → good-task-buffer-list (ak-ibuffers (ak), '4)

Event: Disable good-task-buffer-list-ak-ibuffers.

Theorem: plistp-ak-ibuffers good-ak (ak) → plistp (ak-ibuffers (ak))

Event: Disable plistp-ak-ibuffers.

Theorem: good-task-buffer-getnth-from-ak-ibuffers (good-ak (ak) ∧ finite-numberp (id, '16)) → good-task-buffer (getnth (id, ak-ibuffers (ak)), '4)

Event: Disable good-task-buffer-getnth-from-ak-ibuffers.

Theorem: length-ak-obuffers good-ak (ak) → (length (ak-obuffers (ak)) = '16)

Event: Disable length-ak-obuffers.

Theorem: good-task-buffer-list-ak-obuffers good-ak (ak) → good-task-buffer-list (ak-obuffers (ak), '4)

Event: Disable good-task-buffer-list-ak-obuffers.

Theorem: plistp-ak-obuffers good-ak (ak) → plistp (ak-obuffers (ak))

Event: Disable plistp-ak-obuffers.

Theorem: good-task-buffer-getnth-from-ak-obuffers (good-ak (ak) ∧ finite-numberp (id, '16)) → good-task-buffer (getnth (id, ak-obuffers (ak)), '4)

Event: Disable good-task-buffer-getnth-from-ak-obuffers.

Theorem: length-ak-mbuffers good-ak (ak) → (length (ak-mbuffers (ak)) = '16)

Event: Disable length-ak-mbuffers.

Theorem: good-task-buffer-table-ak-mbuffers good-ak (ak) → good-task-buffer-table (ak-mbuffers (ak), '16, '4)

Event: Disable good-task-buffer-table-ak-mbuffers.

Theorem: plistp-ak-mbuffers good-ak (ak) → plistp (ak-mbuffers (ak))

Event: Disable plistp-ak-mbuffers.

Theorem: good-task-buffer-getnth2-from-ak-mbuffers (good-ak (ak) ∧ ((i < '16) ∧ (j < '16))) → good-task-buffer (getnth2 (i, j , ak-mbuffers (ak)), '4)

Event: Disable good-task-buffer-getnth2-from-ak-mbuffers.

Theorem: finite-numberp-ak-taskid (good-ak (ak) ∧ (¬ ak-waiting (ak))) → finite-numberp (ak-taskid (ak), '16)

Event: Disable finite-numberp-ak-taskid. Theorem: plistp-ak-readyq good-ak (ak) → plistp (ak-readyq (ak)) Event: Disable plistp-ak-readyq. Theorem: length-ak-readyq good-ak (ak) → (length (ak-readyq (ak)) < '17) Event: Disable length-ak-readyq. Theorem: finite-number-listp-ak-readyq good-ak (ak) → finite-number-listp (ak-readyq (ak), '16) Event: Disable finite-number-listp-ak-readyq. Theorem: length-ak-status good-ak (ak) → (length (ak-status (ak)) = '16) Event: Disable length-ak-status. Theorem: good-status-list-ak-status good-ak (ak) → good-status-list (ak-status (ak)) Event: Disable good-status-list-ak-status. Theorem: plistp-ak-status good-ak (ak) → plistp (ak-status (ak)) Event: Disable plistp-ak-status. Theorem: good-status-getnth-from-ak-status (good-ak (ak) ∧ (i < '16)) → good-status (getnth (i, ak-status (ak))) Event: Disable good-status-getnth-from-ak-status. Theorem: finite-numberp-ak-rwstate good-ak (ak) → finite-numberp (ak-rwstate (ak), '2) Event: Disable finite-numberp-ak-rwstate.

Theorem: finite-numberp-ak-clock good-ak (ak) → finite-numberp (ak-clock (ak), '65536)

Event: Disable finite-numberp-ak-clock.

Theorem: plistp-ak-iports good-ak (ak) → plistp (ak-iports (ak))

Event: Disable plistp-ak-iports.

Theorem: length-ak-iports good-ak (ak) → (length (ak-iports (ak)) = '16)

Event: Disable length-ak-iports.

Theorem: good-tm-iport-array-ak-iports good-ak (ak) → good-tm-iport-array (ak-iports (ak))

Event: Disable good-tm-iport-array-ak-iports.

Theorem: good-tm-iport-getnth-from-ak-iports (good-ak (ak) ∧ (i < '16)) → good-tm-iport (getnth (i, ak-iports (ak)))

Event: Disable good-tm-iport-getnth-from-ak-iports.

Theorem: plistp-ak-oports good-ak (ak) → plistp (ak-oports (ak))

Event: Disable plistp-ak-oports.

Theorem: length-ak-oports good-ak (ak) → (length (ak-oports (ak)) = '16)

Event: Disable length-ak-oports.

Theorem: good-tm-oport-array-ak-oports good-ak (ak) → good-tm-oport-array (ak-oports (ak))

Event: Disable good-tm-oport-array-ak-oports.

Theorem: good-tm-oport-getnth-from-ak-oports (good-ak (ak) ∧ (i < '16)) → good-tm-oport (getnth (i, ak-oports (ak)))

Event: Disable good-tm-oport-getnth-from-ak-oports.

Theorem: permutation-ak-readyq-ak-ready-set good-ak (ak) → permutation (ak-readyq (ak), ak-ready-set (ak))

Event: Disable permutation-ak-readyq-ak-ready-set.

Theorem: ak-waiting-iff-qemptyp-ak-readyq good-ak (ak) → (ak-waiting (ak) ↔ qemptyp (ak-readyq (ak)))

Event: Disable ak-waiting-iff-qemptyp-ak-readyq.

Event: Let us define the theory good-ak-properties to consist of the following events: ak-waiting-iff-qemptyp-ak-readyq, permutation-ak-readyq-ak-ready-set, good-tm-oport-getnth-from-ak-oports, good-tm-oport-array-ak-oports, lengthak-oports, plistp-ak-oports, good-tm-iport-getnth-from-ak-iports, good-tm-iport-array-ak-iports, length-ak-iports, plistp-ak-iports, finite-numberp-ak-clock, finitenumberp-ak-rwstate, good-status-getnth-from-ak-status, plistp-ak-status, goodstatus-list-ak-status, length-ak-status, finite-number-listp-ak-readyq, length-ak-readyq, plistp-ak-readyq, finite-numberp-ak-taskid, good-task-buffer-getnth2-from-ak-mbuffers, plistp-ak-mbuffers, plistp-good-task-buffer-table, good-task-buffer-table-ak-mbuffers, length-ak-mbuffers, good-task-buffer-getnth-from-ak-obuffers, plistp-ak-obuffers, good-task-buffer-list-ak-obuffers, length-ak-obuffers, good-task-buffer-getnth-from-ak-ibuffers, plistp-ak-ibuffers, good-task-buffer-list-ak-ibuffers, length-ak-ibuffers, good-address-space-getnth-from-ak, good-address-space-list-ak-pstates, length-ak-pstates, ak-shellp-ak.

Event: Let us define the theory queue-facts to consist of the following events: not-qemptyp-enq, not-qfullp-deq, length-enq, length-deq, length-qreplace, qfirstenq, plistp-enq, plistp-deq, plistp-qreplace, finite-numberp-qfirst, finite-number-listp-enq, finite-number-listp-deq, finite-number-listp-qreplace.

Theorem: not-member-index-ready-set (i < n) → (i ∉ index-ready-set (n, status))

Event: Disable not-member-index-ready-set.

Theorem: setp-index-ready-set setp (index-ready-set (n, status))

Event: Disable setp-index-ready-set.

Definition: set-status-induction (i, n, l) = if i ≃ 0 then '0

elseif listp (l) then set-status-induction (i − 1, 1 + n, cdr (l)) else '0 endif

Theorem: index-ready-set-putnth-unready-status ((i < length (l)) ∧ (status-flag-readyp (getnth (i, l)) ∧ (¬ status-flag-readyp (v)))) → (index-ready-set (n, putnth (v, i, l))

= remove (n + i, index-ready-set (n, l)))

Event: Disable index-ready-set-putnth-unready-status.

Theorem: not-status-flag-readyp-list (flag ≠ '0) → (¬ status-flag-readyp (cons (flag, cons (taskid, 'nil))))

Event: Disable not-status-flag-readyp-list.

Theorem: status-flag-readyp-iff-member-index-ready-set1 (i < length (status)) → (status-flag-readyp (getnth (i, status))

= ((n + i) ∈ index-ready-set (n, status)))

Theorem: status-flag-readyp-iff-member-index-ready-set ((i ∈ N) ∧ (i < length (status))) → (status-flag-readyp (getnth (i, status))

= (i ∈ index-ready-set ('0, status)))

Event: Disable status-flag-readyp-iff-member-index-ready-set.

Theorem: status-flag-readyp-getnth (permutation (queue, index-ready-set ('0, status)) ∧ ((¬ qemptyp (queue))

∧ (number-listp (queue) ∧ (qfirst (queue) < length (status))))) → status-flag-readyp (getnth (qfirst (queue), status))

Event: Disable status-flag-readyp-getnth.

Theorem: permutation-deq-index-ready-set-putnth (permutation (queue, index-ready-set ('0, status)) ∧ (number-listp (queue)

∧ (plistp (queue)

∧ ((¬ qemptyp (queue))

∧ ((taskid = qfirst (queue)) ∧ ((flag ≠ '0)

∧ (taskid < length (status))))))))

→ permutation (deq (queue),

index-ready-set ('0,

putnth (cons (flag, cons (x, 'nil)), taskid, status)))

Event: Disable permutation-deq-index-ready-set-putnth.

Definition: number-of-ready-tasks (status) = if listp (status)

then if status-flag-readyp (car (status)) then 1 + number-of-ready-tasks (cdr (status)) else number-of-ready-tasks (cdr (status)) endif

else '0 endif

Definition: number-of-unready-tasks (status) = if listp (status)

then if status-flag-readyp (car (status)) then number-of-unready-tasks (cdr (status)) else 1 + number-of-unready-tasks (cdr (status)) endif

else '0 endif

Theorem: equal-length-status-sum-of-ready-and-unready-tasks length (status) = (number-of-ready-tasks (status) + number-of-unready-tasks (status))

Theorem: leq-number-of-ready-tasks-length-status if length (status) < number-of-ready-tasks (status) then '*1*false else '*1*true endif

Theorem: number-of-unready-tasks-non-zero ((i < length (status)) ∧ (¬ status-flag-readyp (getnth (i, status)))) → ('0 < number-of-unready-tasks (status))

Event: Disable number-of-unready-tasks-non-zero.

Theorem: not-equal-number-of-ready-tasks-length-status ((i < length (status)) ∧ (¬ status-flag-readyp (getnth (i, status)))) → (number-of-ready-tasks (status) ≠ length (status))

Theorem: lessp-number-of-ready-tasks-length-status ((i < length (status)) ∧ (¬ status-flag-readyp (getnth (i, status)))) → (number-of-ready-tasks (status) < length (status))

Theorem: number-of-ready-tasks-equals-length-index-ready-set number-of-ready-tasks (status) = length (index-ready-set (n, status))

Theorem: status-flag-readyp-list status-flag-readyp (cons ('0, cons (x, 'nil)))

Event: Disable status-flag-readyp-list.

Theorem: lessp-car-index-ready-set ((i < n) ∧ listp (index-ready-set (n, l))) → (i < car (index-ready-set (n, l)))

Theorem: lessp-car-index-ready-set-instance listp (index-ready-set (1 + n, l)) → (n < car (index-ready-set (1 + n, l)))

Event: Disable lessp-car-index-ready-set-instance.

Theorem: rewrite-insert-to-cons-crock1 listp (index-ready-set (1 + n, z)) → (insert (n, index-ready-set (1 + n, z))

= cons (n, index-ready-set (1 + n, z)))

Theorem: rewrite-insert-to-cons-crock2 (¬ listp (index-ready-set (1 + n, z))) → (insert (n, index-ready-set (1 + n, z))

= cons (n, index-ready-set (1 + n, z)))

Theorem: rewrite-insert-to-cons-crock insert (n, index-ready-set (1 + n, z)) = cons (n, index-ready-set (1 + n, z))

Event: Disable rewrite-insert-to-cons-crock.

Theorem: index-ready-set-putnth-ready-status ((i < length (l)) ∧ ((¬ status-flag-readyp (getnth (i, l))) ∧ status-flag-readyp (v))) → (index-ready-set (n, putnth (v, i, l))

= insert (n + i, index-ready-set (n, l)))

Event: Disable index-ready-set-putnth-ready-status.

Theorem: sorted-index-ready-set sorted (index-ready-set (n, l))

Event: Disable sorted-index-ready-set.

Theorem: permutation-enq-index-ready-set-putnth (permutation (queue, index-ready-set ('0, status)) ∧ ((¬ status-flag-readyp (getnth (taskid, status)))

∧ (plistp (queue)

∧ ((taskid ∈ N) ∧ (taskid < length (status))))))

→ permutation (enq (taskid, queue),

index-ready-set ('0,

putnth (cons ('0, cons (x, 'nil)), taskid, status)))

Event: Disable permutation-enq-index-ready-set-putnth.

Theorem: number-of-ready-tasks-equals-length-ak-readyq permutation (ak-readyq (ak), ak-ready-set (ak)) → (number-of-ready-tasks (ak-status (ak)) = length (ak-readyq (ak)))

Event: Disable number-of-ready-tasks-equals-length-ak-readyq.

Theorem: ak-waiting-to-sendp-implies-readyq-not-full (good-ak (ak) ∧ (ak-waiting-to-sendp (srcid, destid, ak) ∧ finite-numberp (srcid, '16))) → (¬ qfullp (ak-readyq (ak), '16))

Theorem: ak-waiting-to-receivep-implies-readyq-not-full (good-ak (ak) ∧ (ak-waiting-to-receivep (srcid, destid, ak)

∧ finite-numberp (destid, '16))) → (¬ qfullp (ak-readyq (ak), '16))

Theorem: ak-waiting-to-outputp-implies-readyq-not-full (good-ak (ak) ∧ (ak-waiting-to-outputp (id, ak) ∧ finite-numberp (id, '16))) → (¬ qfullp (ak-readyq (ak), '16))

Theorem: ak-waiting-to-inputp-implies-readyq-not-full (good-ak (ak) ∧ (ak-waiting-to-inputp (id, ak) ∧ finite-numberp (id, '16))) → (¬ qfullp (ak-readyq (ak), '16))

Theorem: good-ak-ak-error-handler (good-ak (ak) ∧ (¬ ak-waiting (ak))) → good-ak (ak-error-handler (ak))

Event: Disable good-ak-ak-error-handler.

Theorem: good-ak-ak-clock-interrupt-handler (good-ak (ak) ∧ (¬ ak-waiting (ak))) → good-ak (ak-clock-interrupt-handler (ak))

Event: Disable good-ak-ak-clock-interrupt-handler.

Theorem: good-ak-ak-block-send (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ ((srcid = ak-taskid (ak)) ∧ finite-numberp (destid, '16)))) → good-ak (ak-block-send (srcid, destid, ak))

Event: Disable good-ak-ak-block-send.

Theorem: ak-waiting-to-receivep-implies-not-status-flag-readyp ak-waiting-to-receivep (srcid, destid, ak) → (¬ status-flag-readyp (getnth (destid, ak-status (ak))))

Theorem: good-ak-ak-execute-send-to-buffer (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ ((¬ qfullp2 (srcid, destid, ak-mbuffers (ak), '4))

∧ (finite-numberp (srcid, '16)

∧ (finite-numberp (destid, '16)

∧ finite-numberp (msg, '65536))))))

→ good-ak (ak-execute-send-to-buffer (msg, srcid, destid, ak))

Event: Disable good-ak-ak-execute-send-to-buffer.

Theorem: good-ak-ak-execute-send (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ (finite-numberp (destid, '16)

∧ finite-numberp (msg, '65536))))

→ good-ak (ak-execute-send (msg, ak-taskid (ak), destid, ak))

Event: Disable good-ak-ak-execute-send.

Theorem: good-ak-ak-block-receive (good-ak (ak)

∧ ((¬ ak-waiting (ak))

∧ ((destid = ak-taskid (ak)) ∧ finite-numberp (srcid, '16)))) → good-ak (ak-block-receive (srcid, destid, ak))

Event: Disable good-ak-ak-block-receive.

Theorem: ak-waiting-to-sendp-implies-not-status-flag-readyp ak-waiting-to-sendp (srcid, destid, ak) → (¬ status-flag-readyp (getnth (srcid, ak-status (ak))))

Theorem: good-status-properties good-status (status) → (plistp (status)

∧ ((length (status) = '2)

∧ (finite-numberp (getnth ('0, status), '6) ∧ finite-numberp (getnth ('1, status), '16))))

Event: Disable good-status-properties.

Theorem: good-ak-ak-execute-receive-from-buffer (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ ((¬ qemptyp2 (srcid, destid, ak-mbuffers (ak)))

∧ (finite-numberp (srcid, '16)

∧ finite-numberp (destid, '16)))))

→ good-ak (ak-execute-receive-from-buffer (srcid, destid, ak))

Event: Disable good-ak-ak-execute-receive-from-buffer.

Theorem: good-ak-ak-execute-receive (good-ak (ak) ∧ ((¬ ak-waiting (ak)) ∧ finite-numberp (srcid, '16))) → good-ak (ak-execute-receive (srcid, ak-taskid (ak), ak))

Event: Disable good-ak-ak-execute-receive.

Theorem: good-ak-ak-block-output (good-ak (ak) ∧ ((¬ ak-waiting (ak)) ∧ (id = ak-taskid (ak)))) → good-ak (ak-block-output (id, ak))

Event: Disable good-ak-ak-block-output.

Theorem: good-ak-obuffers-properties good-ak (ak) → (plistp (ak-obuffers (ak)) ∧ (length (ak-obuffers (ak)) = '16))

Event: Disable good-ak-obuffers-properties.

Theorem: good-ak-ak-execute-output-to-buffer (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ ((¬ qfullp (getnth (id, ak-obuffers (ak)), '4))

∧ (finite-numberp (id, '16)

∧ finite-numberp (char, '65536)))))

→ good-ak (ak-execute-output-to-buffer (char, id, ak))

Event: Disable good-ak-ak-execute-output-to-buffer.

Theorem: good-ak-ak-execute-output (good-ak (ak) ∧ ((¬ ak-waiting (ak)) ∧ finite-numberp (char, '65536))) → good-ak (ak-execute-output (char, ak-taskid (ak), ak))

Event: Disable good-ak-ak-execute-output.

Theorem: good-ak-ak-block-input (good-ak (ak) ∧ ((¬ ak-waiting (ak)) ∧ (id = ak-taskid (ak)))) → good-ak (ak-block-input (id, ak))

Event: Disable good-ak-ak-block-input.

Theorem: good-ak-ibuffers-properties good-ak (ak) → (plistp (ak-ibuffers (ak)) ∧ (length (ak-ibuffers (ak)) = '16))

Event: Disable good-ak-ibuffers-properties.

Theorem: good-ak-ak-execute-input-from-buffer (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ (finite-numberp (id, '16)

∧ (¬ qemptyp (getnth (id, ak-ibuffers (ak)))))))

→ good-ak (ak-execute-input-from-buffer (id, ak))

Event: Disable good-ak-ak-execute-input-from-buffer.

Theorem: good-ak-ak-execute-input (good-ak (ak) ∧ (¬ ak-waiting (ak))) → good-ak (ak-execute-input (ak-taskid (ak), ak))

Event: Disable good-ak-ak-execute-input.

Theorem: finite-numberp-ak-srcid good-ak (ak) → finite-numberp (ak-srcid (ak), '16)

Event: Disable finite-numberp-ak-srcid.

Theorem: finite-numberp-ak-destid good-ak (ak) → finite-numberp (ak-destid (ak), '16)

Event: Disable finite-numberp-ak-destid.

Theorem: finite-numberp-ak-message (good-ak (ak) ∧ (¬ ak-waiting (ak))) → finite-numberp (ak-message (ak), '65536)

Event: Disable finite-numberp-ak-message.

Theorem: good-ak-ak-svc-handler (good-ak (ak) ∧ (¬ ak-waiting (ak))) → good-ak (ak-svc-handler (ak))

Event: Disable good-ak-ak-svc-handler.

Theorem: good-ak-ak-private-step (good-ak (ak) ∧ (¬ ak-waiting (ak))) → good-ak (ak-private-step (ak))

Event: Disable good-ak-ak-private-step.

Theorem: ak-waiting-to-inputp-implies-not-status-flag-readyp ak-waiting-to-inputp (id, ak) → (¬ status-flag-readyp (getnth (id, ak-status (ak))))

Theorem: ak-waiting-to-outputp-implies-not-status-flag-readyp ak-waiting-to-outputp (id, ak) → (¬ status-flag-readyp (getnth (id, ak-status (ak))))

Theorem: good-tm-iport-properties good-tm-iport (port) → (tm-iportp (port)

∧ (finite-numberp (tm-iinterrupt-flag (port), '2)

∧ (finite-numberp (tm-ierror-flag (port), '2) ∧ finite-numberp (tm-ichar (port), '256))))

Event: Disable good-tm-iport-properties.

Theorem: good-ak-ak-waiting-input-interrupt-handler-case1 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ (ak-waiting (ak) ∧ ak-waiting-to-inputp (id, ak)))) → good-ak (ak-waiting-input-interrupt-handler (id, ak))

Theorem: good-ak-ak-waiting-input-interrupt-handler-case2 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ (ak-waiting (ak) ∧ (¬ ak-waiting-to-inputp (id, ak))))) → good-ak (ak-waiting-input-interrupt-handler (id, ak))

Theorem: good-ak-ak-waiting-input-interrupt-handler (good-ak (ak) ∧ (finite-numberp (id, '16) ∧ ak-waiting (ak))) → good-ak (ak-waiting-input-interrupt-handler (id, ak))

Event: Disable good-ak-ak-waiting-input-interrupt-handler.

Theorem: good-ak-ak-running-input-interrupt-handler-case1 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ ((¬ ak-waiting (ak)) ∧ ak-waiting-to-inputp (id, ak)))) → good-ak (ak-running-input-interrupt-handler (id, ak))

Theorem: good-ak-ak-running-input-interrupt-handler-case2 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ ((¬ ak-waiting (ak)) ∧ (¬ ak-waiting-to-inputp (id, ak))))) → good-ak (ak-running-input-interrupt-handler (id, ak))

Theorem: good-ak-ak-running-input-interrupt-handler (good-ak (ak) ∧ (finite-numberp (id, '16) ∧ (¬ ak-waiting (ak)))) → good-ak (ak-running-input-interrupt-handler (id, ak))

Event: Disable good-ak-ak-running-input-interrupt-handler.

Theorem: finite-numberp-interrupting-ak-input-port (good-ak (ak) ∧ tm-some-input-interruptp (ak-iports (ak))) → finite-numberp (tm-interrupting-input-port (ak-iports (ak)), '16)

Event: Disable finite-numberp-interrupting-ak-input-port.

Theorem: good-ak-ak-input-interrupt-handler (good-ak (ak) ∧ ak-input-interruptp (ak)) → good-ak (ak-input-interrupt-handler (ak-interrupting-input-port (ak-iports (ak)),

ak))

Event: Disable good-ak-ak-input-interrupt-handler.

Theorem: good-tm-oport-properties good-tm-oport (port) → (tm-oportp (port)

∧ (finite-numberp (tm-ointerrupt-flag (port), '2)

∧ (finite-numberp (tm-obusy-flag (port), '2) ∧ finite-numberp (tm-ochar (port), '256))))

Event: Disable good-tm-oport-properties.

Theorem: good-ak-ak-waiting-output-interrupt-handler-case1 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ (ak-waiting (ak) ∧ ak-waiting-to-outputp (id, ak)))) → good-ak (ak-waiting-output-interrupt-handler (id, ak))

Theorem: good-ak-ak-waiting-output-interrupt-handler-case2 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ (ak-waiting (ak) ∧ (¬ ak-waiting-to-outputp (id, ak))))) → good-ak (ak-waiting-output-interrupt-handler (id, ak))

Theorem: good-ak-ak-waiting-output-interrupt-handler (good-ak (ak) ∧ (finite-numberp (id, '16) ∧ ak-waiting (ak))) → good-ak (ak-waiting-output-interrupt-handler (id, ak))

Event: Disable good-ak-ak-waiting-output-interrupt-handler.

Theorem: good-ak-ak-running-output-interrupt-handler-case1 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ ((¬ ak-waiting (ak)) ∧ ak-waiting-to-outputp (id, ak)))) → good-ak (ak-running-output-interrupt-handler (id, ak))

Theorem: good-ak-ak-running-output-interrupt-handler-case2 (good-ak (ak) ∧ (finite-numberp (id, '16)

∧ ((¬ ak-waiting (ak)) ∧ (¬ ak-waiting-to-outputp (id, ak))))) → good-ak (ak-running-output-interrupt-handler (id, ak))

Theorem: good-ak-ak-running-output-interrupt-handler (good-ak (ak) ∧ (finite-numberp (id, '16) ∧ (¬ ak-waiting (ak)))) → good-ak (ak-running-output-interrupt-handler (id, ak))

Event: Disable good-ak-ak-running-output-interrupt-handler.

Theorem: finite-numberp-interrupting-ak-output-port (good-ak (ak) ∧ tm-some-output-interruptp (ak-oports (ak))) → finite-numberp (tm-interrupting-output-port (ak-oports (ak)), '16)

Event: Disable finite-numberp-interrupting-ak-output-port.

Theorem: good-ak-ak-output-interrupt-handler (good-ak (ak) ∧ ak-output-interruptp (ak)) → good-ak (ak-output-interrupt-handler (ak-interrupting-output-port (ak-oports (ak)),

ak))

Event: Disable good-ak-ak-output-interrupt-handler.

Theorem: good-ak-ak-step good-ak (ak) → good-ak (ak-step (ak))

Event: Disable good-ak-ak-step.

Theorem: good-ak-ak-post-input-interrupt (good-ak (ak) ∧ tm-device-input-eventp (interrupt)) → good-ak (ak-post-interrupt (interrupt, ak))

Event: Disable good-ak-ak-post-input-interrupt.

Theorem: good-ak-ak-post-output-interrupt (good-ak (ak) ∧ tm-device-output-eventp (interrupt)) → good-ak (ak-post-interrupt (interrupt, ak))

Event: Disable good-ak-ak-post-output-interrupt.

Theorem: good-ak-ak-post-interrupt-noop (good-ak (ak) ∧ ((¬ tm-device-input-eventp (interrupt))

∧ (¬ tm-device-output-eventp (interrupt)))) → good-ak (ak-post-interrupt (interrupt, ak))

Event: Disable good-ak-ak-post-interrupt-noop.

Theorem: good-ak-ak-post-interrupt good-ak (ak) → good-ak (ak-post-interrupt (interrupt, ak))

Event: Disable good-ak-ak-post-interrupt.

Theorem: good-ak-ak-processor good-ak (ak) → good-ak (ak-processor (ak, oracle))

Event: Disable good-ak-ak-processor.

Theorem: ak-pstates-ak-clock-interrupt-handler ak-pstates (ak-clock-interrupt-handler (ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-clock-interrupt-handler.

Theorem: ak-pstates-ak-error-handler ak-pstates (ak-error-handler (ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-error-handler.

Theorem: ak-pstates-ak-block-send ak-pstates (ak-block-send (srcid, destid, ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-block-send.

Theorem: length-ak-pstates-ak-execute-send-to-buffer length (ak-pstates (ak-execute-send-to-buffer (msg, srcid, destid, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-send-to-buffer.

Theorem: length-ak-pstates-ak-execute-send length (ak-pstates (ak-execute-send (msg, srcid, destid, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-send.

Theorem: ak-pstates-ak-block-receive ak-pstates (ak-block-receive (srcid, destid, ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-block-receive.

Theorem: length-ak-pstates-ak-execute-receive-from-buffer length (ak-pstates (ak-execute-receive-from-buffer (srcid, destid, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-receive-from-buffer.

Theorem: length-ak-pstates-ak-execute-receive length (ak-pstates (ak-execute-receive (srcid, destid, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-receive.

Theorem: ak-pstates-ak-block-output ak-pstates (ak-block-output (id, ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-block-output.

Theorem: length-ak-pstates-ak-execute-output-to-buffer length (ak-pstates (ak-execute-output-to-buffer (char, id, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-output-to-buffer.

Theorem: length-ak-pstates-ak-execute-output length (ak-pstates (ak-execute-output (char, id, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-output.

Theorem: ak-pstates-ak-block-input ak-pstates (ak-block-input (id, ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-block-input.

Theorem: length-ak-pstates-ak-execute-input-from-buffer length (ak-pstates (ak-execute-input-from-buffer (id, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-input-from-buffer.

Theorem: length-ak-pstates-ak-execute-input length (ak-pstates (ak-execute-input (id, ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-execute-input.

Theorem: length-ak-pstates-ak-svc-handler length (ak-pstates (ak-svc-handler (ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-svc-handler.

Theorem: ak-pstates-ak-input-interrupt-handler ak-pstates (ak-input-interrupt-handler (id, ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-input-interrupt-handler.

Theorem: ak-pstates-ak-output-interrupt-handler ak-pstates (ak-output-interrupt-handler (id, ak)) = ak-pstates (ak)

Event: Disable ak-pstates-ak-output-interrupt-handler.

Theorem: length-ak-pstates-ak-private-step length (ak-pstates (ak-private-step (ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-private-step.

Theorem: length-ak-pstates-ak-step length (ak-pstates (ak-step (ak))) = length (ak-pstates (ak))

Event: Disable length-ak-pstates-ak-step.

Definition: ak-channels (ak) = cons (ak-ibuffers (ak),

cons (ak-obuffers (ak), cons (ak-mbuffers (ak), 'nil)))

Definition: project (i, ak) = task (getnth (i, ak-pstates (ak)), ak-channels (ak))

Definition: control-oracle-step (i, ak) = if ak-input-interruptp (ak)

then ak-channels (ak-input-interrupt-handler (tm-interrupting-input-port (ak-iports (ak)),

ak))

elseif ak-output-interruptp (ak)

then ak-channels (ak-output-interrupt-handler (tm-interrupting-output-port (ak-oports (ak)),

ak))

elseif ak-waiting (ak) then ak-channels (ak) elseif ak-errorp (ak) then ak-channels (ak-error-handler (ak)) elseif ak-clock-interruptp (ak) then ak-channels (ak-clock-interrupt-handler (ak)) elseif ak-svc-interruptp (ak) then if i = ak-taskid (ak) then '*1*true

else ak-channels (ak-svc-handler (ak)) endif elseif i = ak-taskid (ak) then '*1*true else ak-channels (ak-private-step (ak)) endif

Definition: control-oracle (i, ak, oracle) = if listp (oracle)

then cons (control-oracle-step (i, ak-post-interrupt (car (oracle), ak)),

control-oracle (i, ak-step (ak-post-interrupt (car (oracle), ak)), cdr (oracle)))

else 'nil endif

Theorem: access-ak-post-interrupt (ak-pstates (ak-post-interrupt (interrupt, ak)) = ak-pstates (ak)) ∧ ((ak-ibuffers (ak-post-interrupt (interrupt, ak)) = ak-ibuffers (ak))

∧ ((ak-obuffers (ak-post-interrupt (interrupt, ak)) = ak-obuffers (ak)) ∧ ((ak-mbuffers (ak-post-interrupt (interrupt, ak))

= ak-mbuffers (ak))

∧ (ak-taskid (ak-post-interrupt (interrupt, ak)) = ak-taskid (ak)))))

Event: Disable access-ak-post-interrupt.

Theorem: access-ak-input-interrupt-handler (ak-pstates (ak-input-interrupt-handler (id, ak)) = ak-pstates (ak)) ∧ ((ak-obuffers (ak-input-interrupt-handler (id, ak)) = ak-obuffers (ak))

∧ (ak-mbuffers (ak-input-interrupt-handler (id, ak)) = ak-mbuffers (ak)))

Event: Disable access-ak-input-interrupt-handler.

Theorem: access-ak-output-interrupt-handler (ak-pstates (ak-output-interrupt-handler (id, ak)) = ak-pstates (ak)) ∧ ((ak-ibuffers (ak-output-interrupt-handler (id, ak)) = ak-ibuffers (ak))

∧ (ak-mbuffers (ak-output-interrupt-handler (id, ak)) = ak-mbuffers (ak)))

Event: Disable access-ak-output-interrupt-handler.

Theorem: access-ak-error-handler (ak-pstates (ak-error-handler (ak)) = ak-pstates (ak)) ∧ ((ak-ibuffers (ak-error-handler (ak)) = ak-ibuffers (ak))

∧ ((ak-obuffers (ak-error-handler (ak)) = ak-obuffers (ak))

∧ (ak-mbuffers (ak-error-handler (ak)) = ak-mbuffers (ak))))

Event: Disable access-ak-error-handler.

Theorem: ak-private-step-non-interference (good-ak (ak) ∧ (finite-numberp (i, length (ak-pstates (ak)))

∧ ((i ≠ ak-taskid (ak)) ∧ (¬ ak-waiting (ak))))) → (getnth (i, ak-pstates (ak-private-step (ak)))

= getnth (i, ak-pstates (ak)))

Event: Disable ak-private-step-non-interference.

Theorem: ak-svc-handler-non-interference (good-ak (ak) ∧ (finite-numberp (i, length (ak-pstates (ak)))

∧ ((i ≠ ak-taskid (ak)) ∧ (¬ ak-waiting (ak))))) → (getnth (i, ak-pstates (ak-svc-handler (ak)))

= getnth (i, ak-pstates (ak)))

Event: Disable ak-svc-handler-non-interference.

Theorem: ak-implements-non-active-task-step (good-ak (ak) ∧ (finite-numberp (i, length (ak-pstates (ak)))

∧ (¬ task-activep (control-oracle-step (i,

ak-post-interrupt (car (oracle),

ak))))))

→ (project (i, ak-step (ak-post-interrupt (car (oracle), ak)))

= task-update-channels (project (i, ak),

control-oracle-step (i,

ak-post-interrupt (car (oracle), ak))))

Event: Disable ak-implements-non-active-task-step.

Theorem: ak-execute-receive-implements-task-execute-receive (good-ak (ak) ∧ (¬ ak-waiting (ak))) → (task (getnth (ak-taskid (ak),

ak-pstates (ak-execute-receive (ak-srcid (ak), ak-taskid (ak), ak))),

ak-channels (ak-execute-receive (ak-srcid (ak), ak-taskid (ak), ak))) = task-execute-receive (task-srcid (task (getnth (ak-taskid (ak),

ak-pstates (ak)), ak-channels (ak))),

ak-taskid (ak),

task (getnth (ak-taskid (ak), ak-pstates (ak)), ak-channels (ak))))

Event: Disable ak-execute-receive-implements-task-execute-receive.

Theorem: ak-execute-send-implements-task-execute-send (good-ak (ak) ∧ (¬ ak-waiting (ak))) → (task (getnth (ak-taskid (ak),

ak-pstates (ak-execute-send (ak-message (ak), ak-taskid (ak), ak-destid (ak), ak))),

ak-channels (ak-execute-send (ak-message (ak), ak-taskid (ak), ak-destid (ak), ak)))

= task-execute-send (task-message (task (getnth (ak-taskid (ak),

ak-pstates (ak)), ak-channels (ak))),

ak-taskid (ak),

task-destid (task (getnth (ak-taskid (ak),

ak-pstates (ak)), ak-channels (ak))),

task (getnth (ak-taskid (ak), ak-pstates (ak)), ak-channels (ak))))

Event: Disable ak-execute-send-implements-task-execute-send.

Theorem: ak-execute-input-implements-task-execute-input (good-ak (ak) ∧ (¬ ak-waiting (ak))) → (task (getnth (ak-taskid (ak),

ak-pstates (ak-execute-input (ak-taskid (ak), ak))),

ak-channels (ak-execute-input (ak-taskid (ak), ak))) = task-execute-input (ak-taskid (ak),

task (getnth (ak-taskid (ak), ak-pstates (ak)), ak-channels (ak))))

Event: Disable ak-execute-input-implements-task-execute-input.

Theorem: ak-execute-output-implements-task-execute-output (good-ak (ak) ∧ (¬ ak-waiting (ak))) → (task (getnth (ak-taskid (ak),

ak-pstates (ak-execute-output (ak-message (ak), ak-taskid (ak), ak))),

ak-channels (ak-execute-output (ak-message (ak), ak-taskid (ak), ak))) = task-execute-output (task-message (task (getnth (ak-taskid (ak),

ak-pstates (ak)), ak-channels (ak))),

ak-taskid (ak),

task (getnth (ak-taskid (ak), ak-pstates (ak)), ak-channels (ak))))

Event: Disable ak-execute-output-implements-task-execute-output.

Theorem: ak-svc-handler-implements-task-communication-step (good-ak (ak) ∧ (¬ ak-waiting (ak))) → (task (getnth (ak-taskid (ak), ak-pstates (ak-svc-handler (ak))),

ak-channels (ak-svc-handler (ak))) = task-communication-step (task (getnth (ak-taskid (ak),

ak-pstates (ak)), ak-channels (ak)),

ak-taskid (ak)))

Event: Disable ak-svc-handler-implements-task-communication-step.

Theorem: ak-private-step-implements-task-fetch-execute (good-ak (ak) ∧ ((¬ ak-waiting (ak))

∧ (finite-numberp (i, length (ak-pstates (ak)))

∧ (i = ak-taskid (ak)))))

→ (task (getnth (i, ak-pstates (ak-private-step (ak))),

ak-channels (ak-private-step (ak))) = task (tm-fetch-execute (getnth (i, ak-pstates (ak))),

ak-channels (ak)))

Event: Disable ak-private-step-implements-task-fetch-execute.

Theorem: ak-implements-active-task-step (good-ak (ak) ∧ (finite-numberp (i, length (ak-pstates (ak)))

∧ task-activep (control-oracle-step (i,

ak-post-interrupt (car (oracle),

ak)))))

→ (project (i, ak-step (ak-post-interrupt (car (oracle), ak))) = task-step (project (i, ak), i))

Event: Disable ak-implements-active-task-step.

Theorem: ak-implements-parallel-tasks (good-ak (ak) ∧ finite-numberp (i, length (ak-pstates (ak)))) → (project (i, ak-processor (ak, oracle))

= task-processor (project (i, ak), i, control-oracle (i, ak, oracle)))

Event: Disable ak-implements-parallel-tasks.

Definition: asm-opcode-alist

= '((return . 0)
(wait . 4)
(run . 8)
(br . 2)
(brz . 10)
(brnz . 6)
(call . 14)
(decr . 18)
(decrm . 5)
(incr . 22)
(incrm . 7)
(lbase . 26)
(llimit . 30)
(lpsw . 34)
(post . 38)
(svc . 42)
(svcr . 46)
(time . 58)
(add . 1)
(compare . 3)
(mod . 9)

      (move . 11)
      (mult . 13)
      (stout . 15)
      (testi . 50)
      (testo . 54))

Definition: append-n-times (n, list) = if n ≃ 0 then 'nil

else append (list, append-n-times (n − 1, list)) endif

Definition: lookup (x, alist) = if listp (alist)

then if listp (car (alist)) ∧ (x = car (car (alist))) then cdr (car (alist)) else lookup (x, cdr (alist)) endif

else 'nil endif

Definition: boundp (x, alist) = if listp (alist)

then if listp (car (alist))

then if x = car (car (alist)) then '*1*true else boundp (x, cdr (alist)) endif

else boundp (x, cdr (alist)) endif

    else '*1*false endif

Definition: number-and-litatom-listp (x) = if listp (x)

then ((car (x) ∈ N) ∨ litatom (car (x)))

∧ number-and-litatom-listp (cdr (x)) else '*1*true endif

Definition: dc-formp (x) = (listp (x)

∧ ((car (x) = 'dc)

∧ ((car (cdr (x)) ∈ N)

∧ ((car (cdr (cdr (x))) ∈ N)

∨ (litatom (car (cdr (cdr (x))))

∨ (listp (car (cdr (cdr (x)))) ∨ number-and-litatom-listp (car (cdr (cdr (x))))))))))

Definition: translate-dc-arg (arg, symtab) = if arg ∈ N then arg

elseif litatom (arg) then if boundp (arg, symtab) then lookup (arg, symtab)

else arg endif else arg endif

Definition: translate-dc-arglist (arglist, symtab) = if listp (arglist)

then cons (translate-dc-arg (car (arglist), symtab),

translate-dc-arglist (cdr (arglist), symtab))

else 'nil endif

Definition: translate-dc (dc-form, symtab) = if dc-formp (dc-form)

then append-n-times (car (cdr (dc-form)),

translate-dc-arglist (if listp (car (cdr (cdr (dc-form)))) then car (cdr (cdr (dc-form))) else cons (car (cdr (cdr (dc-form))), 'nil) endif,

symtab))

else dc-form endif

Definition: asm-instruction-opcode (instruction) = lookup (car (instruction),

'((return . 0)
(wait . 4)
(run . 8)
(br . 2)
(brz . 10)
(brnz . 6)
(call . 14)
(decr . 18)
(decrm . 5)
(incr . 22)
(incrm . 7)
(lbase . 26)
(llimit . 30)
(lpsw . 34)
(post . 38)
(svc . 42)

            (svcr . 46)
            (time . 58)
            (add . 1)
            (compare . 3)
            (mod . 9)
            (move . 11)
            (mult . 13)
            (stout . 15)
            (testi . 50)
            (testo . 54)))

Definition: asm-instruction-mode1 (instruction, symtab) = if listp (car (cdr (instruction)))

then if boundp (car (car (cdr (instruction))), symtab)

then lookup (car (car (cdr (instruction))), symtab)

else car (car (cdr (instruction))) endif else '0 endif

Definition: asm-instruction-arg1 (instruction, symtab) = if listp (car (cdr (instruction)))

then if boundp (car (cdr (car (cdr (instruction)))), symtab) then lookup (car (cdr (car (cdr (instruction)))), symtab) else car (cdr (car (cdr (instruction)))) endif

elseif boundp (car (cdr (instruction)), symtab) then lookup (car (cdr (instruction)), symtab) else car (cdr (instruction)) endif

Definition: asm-instruction-index1 (instruction, symtab) = if listp (car (cdr (instruction)))

then if boundp (car (cdr (cdr (car (cdr (instruction))))), symtab) then lookup (car (cdr (cdr (car (cdr (instruction))))), symtab) else car (cdr (cdr (car (cdr (instruction))))) endif

else '0 endif

Definition: asm-instruction-mode2 (instruction, symtab) = if listp (car (cdr (cdr (instruction))))

then if boundp (car (car (cdr (cdr (instruction)))), symtab) then lookup (car (car (cdr (cdr (instruction)))), symtab) else car (car (cdr (cdr (instruction)))) endif

else '0 endif Definition: asm-instruction-arg2 (instruction, symtab) = if listp (car (cdr (cdr (instruction))))

then if boundp (car (cdr (car (cdr (cdr (instruction))))), symtab) then lookup (car (cdr (car (cdr (cdr (instruction))))), symtab) else car (cdr (car (cdr (cdr (instruction))))) endif

elseif boundp (car (cdr (cdr (instruction))), symtab) then lookup (car (cdr (cdr (instruction))), symtab) else car (cdr (cdr (instruction))) endif

Definition: asm-instruction-index2 (instruction, symtab) = if listp (car (cdr (cdr (instruction))))

then if boundp (car (cdr (cdr (car (cdr (cdr (instruction)))))), symtab) then lookup (car (cdr (cdr (car (cdr (cdr (instruction)))))), symtab) else car (cdr (cdr (car (cdr (cdr (instruction)))))) endif

else '0 endif

Definition: asm-good-arg (arg, mode) = if (mode = '0) ∨ (mode = '2) then finite-numberp (arg, '65536)

else finite-numberp (arg, '8) endif

Definition: asm-good-instruction (instruction, symtab) = (boundp (car (instruction),

'((return . 0)
(wait . 4)
(run . 8)
(br . 2)
(brz . 10)
(brnz . 6)
(call . 14)
(decr . 18)
(decrm . 5)
(incr . 22)
(incrm . 7)
(lbase . 26)
(llimit . 30)
(lpsw . 34)
(post . 38)
(svc . 42)
(svcr . 46)
(time . 58)
(add . 1)

(compare . 3)
(mod . 9)
(move . 11)
(mult . 13)
(stout . 15)
(testi . 50)
(testo . 54)))

∧ ((length (instruction)

= if tm-nullary-instructionp (lookup (car (instruction),

'((return
 . 0)
(wait . 4)
(run . 8)
(br . 2)
(brz . 10)
(brnz . 6)
(call . 14)
(decr . 18)
(decrm . 5)
(incr . 22)
(incrm . 7)
(lbase
 . 26)
(llimit
 . 30)
(lpsw . 34)
(post . 38)
(svc . 42)
(svcr . 46)
(time . 58)
(add . 1)
(compare
 . 3)
(mod . 9)
(move . 11)
(mult . 13)
(stout
 . 15)
(testi
 . 50)
(testo
 . 54))))

then '1 elseif tm-unary-instructionp (lookup (car (instruction),

'((return
 . 0)
(wait . 4)
(run . 8)
(br . 2)
(brz . 10)
(brnz . 6)
(call
 . 14)
(decr
 . 18)
(decrm
 . 5)
(incr
 . 22)
(incrm
 . 7)
(lbase
 . 26)
(llimit
 . 30)
(lpsw
 . 34)
(post
 . 38)
(svc . 42)
(svcr
 . 46)
(time
 . 58)
(add . 1)
(compare
 . 3)
(mod . 9)
(move
 . 11)
(mult
 . 13)
(stout
 . 15)
(testi
 . 50)
(testo
 . 54))))

then '2

else '3 endif) ∧ (finite-numberp (asm-instruction-mode1 (instruction,

symtab),

                          '4)

∧ (finite-numberp (asm-instruction-mode2 (instruction,

symtab),

                              '4)

∧ (asm-good-arg (asm-instruction-arg1 (instruction,

symtab),

asm-instruction-mode1 (instruction,

symtab))

∧ (asm-good-arg (asm-instruction-arg2 (instruction,

symtab),

asm-instruction-mode2 (instruction,

symtab))

∧ (finite-numberp (asm-instruction-index1 (instruction,

symtab),

                                          '8)

∧ finite-numberp (asm-instruction-index2 (instruction,

symtab),

'8))))))))

Definition: asm-pack-word1 (instruction, symtab) = if length (instruction) = '1

then asm-instruction-opcode (instruction) elseif length (instruction) = '2 then asm-instruction-opcode (instruction)

+ ((asm-instruction-mode1 (instruction, symtab) ∗ '64) + (asm-instruction-index1 (instruction, symtab)

                 ∗ '256))

else asm-instruction-opcode (instruction)

+ ((asm-instruction-mode1 (instruction, symtab)

             ∗ '64)

+ ((asm-instruction-index1 (instruction, symtab)

                 ∗ '256)

+ ((asm-instruction-mode2 (instruction,

symtab)

                      ∗ '2048)

+ (asm-instruction-index2 (instruction,

symtab)

∗ '8192)))) endif

Definition: asm-pack-instruction (instruction, symtab) = if length (instruction) = '1

then cons (asm-pack-word1 (instruction, symtab), 'nil) elseif length (instruction) = '2 then cons (asm-pack-word1 (instruction, symtab),

cons (asm-instruction-arg1 (instruction, symtab), 'nil))

else cons (asm-pack-word1 (instruction, symtab),

cons (asm-instruction-arg1 (instruction, symtab),

cons (asm-instruction-arg2 (instruction, symtab), 'nil))) endif

Definition: translate-instruction (instruction, symtab) = if asm-good-instruction (instruction, symtab)

then asm-pack-instruction (instruction, symtab)

else instruction endif

Definition: translate-source (source, symtab) = if listp (source)

then if litatom (car (source))

then translate-source (cdr (source), symtab)

elseif listp (car (source)) ∧ (car (car (source)) = 'dcl) then translate-source (cdr (source), symtab) elseif listp (car (source)) ∧ (car (car (source)) = 'dc) then append (translate-dc (car (source), symtab),

translate-source (cdr (source), symtab))

else append (translate-instruction (car (source), symtab),

translate-source (cdr (source), symtab)) endif

else 'nil endif

Definition: incr-dc-position (dc-form) = if listp (car (cdr (cdr (dc-form))))

then car (cdr (dc-form)) ∗ length (car (cdr (cdr (dc-form)))) else car (cdr (dc-form)) endif

Definition: incr-instruction-position (instruction) = if boundp (car (instruction),

             '((return . 0)
               (wait . 4)
               (run . 8)
               (br . 2)
               (brz . 10)

(brnz . 6)
(call . 14)
(decr . 18)
(decrm . 5)
(incr . 22)
(incrm . 7)
(lbase . 26)
(llimit . 30)
(lpsw . 34)
(post . 38)
(svc . 42)
(svcr . 46)
(time . 58)
(add . 1)
(compare . 3)
(mod . 9)
(move . 11)
(mult . 13)
(stout . 15)
(testi . 50)
(testo . 54)))

then if tm-nullary-instructionp (lookup (car (instruction),

                       '((return . 0)
                         (wait . 4)
                         (run . 8)
                         (br . 2)
                         (brz . 10)
                         (brnz . 6)
                         (call . 14)
                         (decr . 18)
                         (decrm . 5)
                         (incr . 22)
                         (incrm . 7)
                         (lbase . 26)
                         (llimit . 30)
                         (lpsw . 34)
                         (post . 38)
                         (svc . 42)
                         (svcr . 46)
                         (time . 58)
                         (add . 1)
                         (compare . 3)
                         (mod . 9)
                         (move . 11)

(mult . 13)
(stout . 15)
(testi . 50)
(testo . 54)))) then '1

elseif tm-unary-instructionp (lookup (car (instruction),

'((return . 0)
(wait . 4)
(run . 8)
(br . 2)
(brz . 10)
(brnz . 6)
(call . 14)
(decr . 18)
(decrm . 5)
(incr . 22)
(incrm . 7)
(lbase . 26)
(llimit . 30)
(lpsw . 34)
(post . 38)
(svc . 42)
(svcr . 46)
(time . 58)
(add . 1)
(compare . 3)
(mod . 9)
(move . 11)
(mult . 13)
(stout . 15)
(testi . 50)
(testo . 54))))

then '2 else '3 endif

else '0 endif

Definition: build-symtab (source, symtab, position) = if listp (source)

then if litatom (car (source))

then build-symtab (cdr (source), cons (cons (car (source), position), symtab), position)

elseif listp (car (source)) ∧ (car (car (source)) = 'dcl) then build-symtab (cdr (source), cons (cons (car (cdr (car (source))),

car (cdr (cdr (car (source))))), symtab),

position) elseif listp (car (source)) ∧ (car (car (source)) = 'dc) then build-symtab (cdr (source),

symtab,

position + incr-dc-position (car (source)))

else build-symtab (cdr (source), symtab, position + incr-instruction-position (car (source))) endif

else symtab endif

Definition: find-duplicate-symbol (symtab, already-seen) = if listp (symtab)

then if listp (car (symtab))

then if car (car (symtab)) ∈ already-seen then car (car (symtab))

else find-duplicate-symbol (cdr (symtab),

cons (car (car (symtab)),

already-seen)) endif

else find-duplicate-symbol (cdr (symtab), already-seen) endif

    else '*1*false endif

Definition: assembly-errorp (assembler-result) = (¬ (plistp (assembler-result)

∧ ((length (assembler-result) = '2) ∧ (car (cdr (assembler-result)) = '*1*true))))

Definition: find-non-finite-number (l) = if listp (l)

then if finite-numberp (car (l), '65536) then find-non-finite-number (cdr (l)) else car (l) endif

else 'nil endif

Definition: assemble2 (memory) = if finite-number-tablep ('100, table ('100, memory), '65536)

then cons (memory, '(*1*true))

else cons ('nil,

cons (cons ('assembly,

                      cons ('error,

cons (find-non-finite-number (memory),

                               'nil))),

'nil)) endif

Definition: assemble1 (source, symtab) = if find-duplicate-symbol (symtab, 'nil)

then cons ('nil,

cons (cons ('assembly,

                       cons ('error,
                           cons ('duplicate,
                                cons ('label,

cons (find-duplicate-symbol (symtab,

                                                            'nil),

'nil))))),

                  'nil))

else assemble2 (translate-source (source, symtab)) endif

Definition: assemble (source) = assemble1 (source, build-symtab (source, 'nil, '0))

Event: Let us define the theory assembler to consist of the following events: assemble, assemble1, assemble2, find-non-finite-number, assembly-errorp, findduplicate-symbol, build-symtab, incr-instruction-position, incr-dc-position, translatesource, translate-instruction, asm-pack-instruction, asm-pack-word1, asm-good-instruction, asm-good-arg, asm-instruction-index2, asm-instruction-arg2, asminstruction-mode2, asm-instruction-index1, asm-instruction-arg1, asm-instruction-mode1, asm-instruction-opcode, translate-dc, translate-dc-arglist, translate-dc-arg, dc-formp, number-and-litatom-listp, boundp, append-n-times, asm-opcode-alist.

Definition: reverse-alist (alist) = if listp (alist)

then cons (cons (cdr (car (alist)), car (car (alist))), reverse-alist (cdr (alist)))

else alist endif

Definition: asm-reverse-opcode-alist

= '((0 . return)
      (4 . wait)
      (8 . run)
      (2 . br)

(10 . brz)
(6 . brnz)
(14 . call)
(18 . decr)
(5 . decrm)
(22 . incr)
(7 . incrm)
(26 . lbase)
(30 . llimit)
(34 . lpsw)
(38 . post)
(42 . svc)
(46 . svcr)
(58 . time)
(1 . add)
(3 . compare)
(9 . mod)
(11 . move)
(13 . mult)
(15 . stout)
(50 . testi)
(54 . testo))

Definition: asm-symbolic-opcode (n) = lookup (tm-opcode (n),

     '((0 . return)
       (4 . wait)
       (8 . run)
       (2 . br)
       (10 . brz)
       (6 . brnz)
       (14 . call)
       (18 . decr)
       (5 . decrm)
       (22 . incr)
       (7 . incrm)
       (26 . lbase)
       (30 . llimit)
       (34 . lpsw)
       (38 . post)
       (42 . svc)
       (46 . svcr)
       (58 . time)

            (1 . add)
            (3 . compare)
            (9 . mod)
            (11 . move)
            (13 . mult)
            (15 . stout)
            (50 . testi)
            (54 . testo)))

Definition: os-readyq-length = '20

Definition: os-task-table-length = '144

Definition: os-segment-table-length = '32

Definition: os-status-table-length = '32

Definition: os-ibuffer-length = '8

Definition: os-ibuffers-length = '128

Definition: os-obuffer-length = '8

Definition: os-obuffers-length = '128

Definition: os-mbuffer-length = '8

Definition: os-mbuffers-length = '2048

Definition: os-mbuffers-length-quarter = '512

Theorem: os-mbuffers-length-is-divisible-by-4

 '*1*true

Definition: os-source

= '((dcl r0 0)
      (dcl r1 1)
      (dcl r2 2)
      (dcl r3 3)
      (dcl r4 4)
      (dcl r5 5)
      (dcl r6 6)
      (dcl r7 7)
      (dcl interrupt-pc-field 0)
      (dcl interrupt-sp-field 1)
      (dcl interrupt-flag-field 2)

(dcl svcid-addr 8)
(dcl input-devid-addr 8)
(dcl input-char-addr 9)
(dcl output-devid-addr 9)
(dcl charlub 256)
(dcl send-svcid 0)
(dcl receive-svcid 1)
(dcl tyo-svcid 2)
(dcl tyi-svcid 3)
(dcl task-table-length 144)
(dcl task-table-entry-length 9)
(dcl pc-field 0)
(dcl sp-field 1)
(dcl r2-field 2)
(dcl r3-field 3)
(dcl r4-field 4)
(dcl r5-field 5)
(dcl r6-field 6)
(dcl r7-field 7)
(dcl flag-field 8)
(dcl readyq-length 20)
(dcl qhead-field 0)
(dcl qtail-field 1)
(dcl qcurrlength-field 2)
(dcl qmaxlength-field 3)
(dcl qarray-field 4)
(dcl segment-table-length 32)
(dcl base-field 0)
(dcl limit-field 1)
(dcl status-entry-length 2)
(dcl status-flag-field 0)
(dcl status-taskid-field 1)
(dcl ready-status 0)
(dcl error-status 1)
(dcl send-status 2)
(dcl receive-status 3)
(dcl output-status 4)
(dcl input-status 5)
(dcl input-buffer-length 8)
(dcl output-buffer-length 8)
(dcl message-buffer-length 8)
(dcl source-multiplier 128)
(dcl dest-multiplier 8)
(dcl taskidlub 16)

reg-save-area
(dc 3 0)
clock-new-pc
(dc 1 clock-interrupt-handler)
error-new-pc
(dc 1 error-interrupt-handler)
svc-new-pc
(dc 1 svc-interrupt-handler)
input-new-pc
(dc 1 input-interrupt-handler)
output-new-pc
(dc 1 output-interrupt-handler)
interrupt-data
(dc 2 0)
branch-address
(dc 1 0)
time-slice
(dc 1 1000)
current-taskid
(dc 1 0)
temp-r2
(dc 1 0)
temp-r3
(dc 1 0)
task-table
(dc 144 0)
segment-table
(dc 32 0)
readyq
(dc 20 0)
status-table
(dc 32 0)
ibuffers
(dc 128 0)
obuffers
(dc 128 0)
mbuffers
(dc 512 0)
(dc 512 0)
(dc 512 0)
(dc 512 0)
save-state
(move (2 temp-r2) (1 r2))
(move (2 temp-r3) (1 r3))

(move (1 r3) readyq)
(call qfirst)
save-state-return
(mult (1 r2) task-table-entry-length)
(add (1 r2) task-table)
(move
 (3 r2 pc-field)
 (2 reg-save-area interrupt-pc-field))
(move
 (3 r2 sp-field)
 (2 reg-save-area interrupt-sp-field))
(move (3 r2 r2-field) (2 temp-r2))
(move (3 r2 r3-field) (2 temp-r3))
(move (3 r2 r4-field) (1 r4))
(move (3 r2 r5-field) (1 r5))
(move (3 r2 r6-field) (1 r6))
(move (3 r2 r7-field) (1 r7))
(add (1 r2) flag-field)
(move
 (3 r2)
 (2 reg-save-area interrupt-flag-field))
(move (1 r2) (2 temp-r2))
(move (1 r3) (2 temp-r3))
(return)
restore-state
(move (1 r3) (1 r2))
(mult (1 r2) task-table-entry-length)
(add (1 r2) task-table)
(mult (1 r3) 2)
(add (1 r3) segment-table)
(lbase (3 r3 base-field))
(llimit (3 r3 limit-field))
(move (1 r3) (1 r2))
(add (1 r3) flag-field)
(move
 (2 reg-save-area interrupt-pc-field)
 (3 r2 pc-field))
(move
 (2 reg-save-area interrupt-sp-field)
 (3 r2 sp-field))
(move
 (2 reg-save-area interrupt-flag-field)
 (3 r3))
(move (1 r7) (3 r2 r7-field))

(move (1 r6) (3 r2 r6-field))
(move (1 r5) (3 r2 r5-field))
(move (1 r4) (3 r2 r4-field))
(move (1 r3) (3 r2 r3-field))
(move (1 r2) (3 r2 r2-field))
(return)
clock-interrupt-handler
(call save-state)
trace-label1
(move (1 r3) readyq)
(call qfirst)
(call dequeue)
(call enqueue)
trace-label2
(br dispatcher)
error-interrupt-handler
(call save-state)
trace-label3
(move (1 r3) readyq)
(call qfirst)
(call dequeue)
trace-label4
(mult (1 r2) status-entry-length)
(add (1 r2) status-table)
(move (3 r2 status-flag-field) error-status)
(move (3 r2 status-taskid-field) 0)
(br dispatcher)
svc-interrupt-handler
(call save-state)
trace-label5
(mod (2 svcid-addr) 4)
(compare (2 svcid-addr) send-svcid)
(brz send-svc-handler)
(compare (2 svcid-addr) receive-svcid)
(brz receive-svc-handler)
(compare (2 svcid-addr) tyo-svcid)
(brz tyo-svc-handler)
(br tyi-svc-handler)
send-svc-handler
(move (1 r6) (1 r2))
(mod (1 r6) taskidlub)
(move (1 r7) (1 r3))
(move (1 r3) readyq)
(call qfirst)

trace-label6
(move (2 current-taskid) (1 r2))
(move (1 r4) (1 r6))
(mult (1 r4) dest-multiplier)
(move (1 r3) (1 r2))
(mult (1 r3) source-multiplier)
(add (1 r3) (1 r4))
(add (1 r3) mbuffers)
trace-label7
(call qfullp)
(brz block-send)
(move (1 r2) (1 r7))
(call enqueue)
trace-label8
(move (1 r3) (1 r6))
(mult (1 r3) status-entry-length)
(add (1 r3) status-table)
(compare (3 r3 status-flag-field) receive-status)
(brnz svc-resume-task)
(compare
 (3 r3 status-taskid-field)
 (2 current-taskid))
(brnz svc-resume-task)
(move (3 r3 status-flag-field) ready-status)
(move (3 r3 status-taskid-field) 0)
(move (1 r2) (1 r6))
(move (1 r3) readyq)
(call enqueue)
trace-label9
(br svc-resume-task)
block-send
(move (1 r3) readyq)
(call dequeue)
trace-label10
(move (1 r3) (2 current-taskid))
(mult (1 r3) status-entry-length)
(add (1 r3) status-table)
(move (3 r3 status-flag-field) send-status)
(move (3 r3 status-taskid-field) (1 r6))
(br dispatcher)
receive-svc-handler
(move (1 r6) (1 r2))
(mod (1 r6) taskidlub)
(move (1 r3) readyq)

(call qfirst)
trace-label11
(move (2 current-taskid) (1 r2))
(move (1 r4) (1 r2))
(mult (1 r4) dest-multiplier)
(move (1 r3) (1 r6))
(mult (1 r3) source-multiplier)
(add (1 r3) (1 r4))
(add (1 r3) mbuffers)
trace-label12
(call qemptyp)
(brz block-receive)
(call qfirst)
(call dequeue)
trace-label13
(move (1 r3) (2 current-taskid))
(mult (1 r3) task-table-entry-length)
(add (1 r3) task-table)
(move (3 r3 r3-field) (1 r2))
trace-label14
(move (1 r3) (1 r6))
(mult (1 r3) status-entry-length)
(add (1 r3) status-table)
(compare (3 r3 status-flag-field) send-status)
(brnz svc-resume-task)
(compare
 (3 r3 status-taskid-field)
 (2 current-taskid))
(brnz svc-resume-task)
(move (3 r3 status-flag-field) ready-status)
(move (3 r3 status-taskid-field) 0)
(move (1 r2) (1 r6))
(move (1 r3) readyq)
(call enqueue)
trace-label15
(br svc-resume-task)
block-receive
(move (1 r3) readyq)
(call dequeue)
trace-label16
(move (1 r3) (2 current-taskid))
(mult (1 r3) status-entry-length)
(add (1 r3) status-table)
(move (3 r3 status-flag-field) receive-status)

(move (3 r3 status-taskid-field) (1 r6))
(br dispatcher)
tyo-svc-handler
(move (1 r7) (1 r3))
(move (1 r3) readyq)
(call qfirst)
trace-label17
(move (2 current-taskid) (1 r2))
(move (1 r3) (1 r2))
(mult (1 r3) output-buffer-length)
(add (1 r3) obuffers)
trace-label18
(call qfullp)
(brz block-tyo)
(move (1 r2) (1 r7))
(call enqueue)
trace-label19
(testo (2 current-taskid))
(brnz svc-resume-task)
(post (2 current-taskid))
(br svc-resume-task)
block-tyo
(move (1 r3) readyq)
(call dequeue)
trace-label20
(move (1 r3) (2 current-taskid))
(mult (1 r3) status-entry-length)
(add (1 r3) status-table)
(move (3 r3 status-flag-field) output-status)
(move (3 r3 status-taskid-field) 0)
(br dispatcher)
tyi-svc-handler
(move (1 r3) readyq)
(call qfirst)
trace-label21
(move (2 current-taskid) (1 r2))
(move (1 r3) (1 r2))
(mult (1 r3) input-buffer-length)
(add (1 r3) ibuffers)
trace-label22
(call qemptyp)
(brz block-tyi)
(call qfirst)
(call dequeue)

trace-label23
(move (1 r3) (2 current-taskid))
(mult (1 r3) task-table-entry-length)
(add (1 r3) task-table)
(move (3 r3 r3-field) (1 r2))
(br svc-resume-task)
block-tyi
(move (1 r3) readyq)
(call dequeue)
trace-label24
(move (1 r3) (2 current-taskid))
(mult (1 r3) status-entry-length)
(add (1 r3) status-table)
(move (3 r3 status-flag-field) input-status)
(move (3 r3 status-taskid-field) 0)
(br dispatcher)
input-interrupt-handler
(move (2 branch-address) dispatcher)
(move (2 temp-r3) (1 r3))
(move (1 r3) readyq)
(call qemptyp)
trace-label25
(brz iih-skip-save-state)
(move (2 branch-address) resume-task)
(move (1 r3) (2 temp-r3))
(call save-state)
trace-label26 iih-skip-save-state
(move (1 r5) (2 input-devid-addr))
(mult (1 r5) status-entry-length)
(add (1 r5) status-table)
(compare (3 r5 status-flag-field) input-status)
(brnz check-for-full-input-buffer)
(move (1 r2) (2 input-devid-addr))
(move (1 r3) readyq)
(call enqueue)
trace-label27
(move (3 r5 status-flag-field) ready-status)
(move (3 r5 status-taskid-field) 0)
trace-label28 check-for-full-input-buffer
(move (1 r3) (2 input-devid-addr))
(mult (1 r3) input-buffer-length)
(add (1 r3) ibuffers)
(call qfullp)
(brnz check-for-iport-error)

(move (1 r2) (2 input-char-addr))
(add (1 r2) charlub)
(call qreplace)
trace-label29
(br (2 branch-address))
check-for-iport-error
(testi (2 input-devid-addr))
(brnz enqueue-input-character)
(move (1 r2) (2 input-char-addr))
(add (1 r2) charlub)
(call enqueue)
trace-label30
(br (2 branch-address))
enqueue-input-character
(move (1 r2) (2 input-char-addr))
(call enqueue)
trace-label31
(br (2 branch-address))
output-interrupt-handler
(move (2 branch-address) dispatcher)
(move (2 temp-r3) (1 r3))
(move (1 r3) readyq)
(call qemptyp)
trace-label32
(brz oih-skip-save-state)
(move (2 branch-address) resume-task)
(move (1 r3) (2 temp-r3))
(call save-state)
trace-label33 oih-skip-save-state
(move (1 r5) (2 output-devid-addr))
(mult (1 r5) status-entry-length)
(add (1 r5) status-table)
(compare (3 r5 status-flag-field) output-status)
(brnz check-for-empty-output-buffer)
(move (1 r2) (2 output-devid-addr))
(move (1 r3) readyq)
(call enqueue)
trace-label34
(move (3 r5 status-flag-field) ready-status)
(move (3 r5 status-taskid-field) 0)
trace-label35 check-for-empty-output-buffer
(move (1 r3) (2 output-devid-addr))
(mult (1 r3) output-buffer-length)
(add (1 r3) obuffers)

(call qemptyp)
(brz (2 branch-address))
(call qfirst)
(stout (2 output-devid-addr) (1 r2))
(call dequeue)
trace-label36
(br (2 branch-address))
dispatcher
(move (1 r3) readyq)
(call qemptyp)
dispatcher-trace-label1
(brz readyq-empty)
(call qfirst)
(call restore-state)
dispatcher-trace-label2
(time (2 time-slice 0))
(lpsw (2 reg-save-area))
readyq-empty
(wait)
pc-after-wait svc-resume-task
(move (1 r3) readyq)
(call qfirst)
(call restore-state)
svc-resume-task-trace-label1
(svcr (2 reg-save-area))
resume-task
(move (1 r3) readyq)
(call qfirst)
(call restore-state)
resume-task-trace-label1
(lpsw (2 reg-save-area))
enqueue
(move (1 r4) (1 r3))
(add (1 r4) qarray-field)
(add (1 r4) (3 r3 qtail-field))
(move (3 r4) (1 r2))
(incr (3 r3 qcurrlength-field))
(incrm (3 r3 qtail-field) (3 r3 qmaxlength-field))
(return)
qreplace
(move (1 r4) (3 r3 qtail-field))
(decrm (1 r4) (3 r3 qmaxlength-field))
(add (1 r4) (1 r3))
(add (1 r4) qarray-field)

(move (3 r4) (1 r2))
(return)
dequeue
(decr (3 r3 qcurrlength-field))
(incrm (3 r3 qhead-field) (3 r3 qmaxlength-field))
(return)
qfirst
(move (1 r2) (1 r3))
(add (1 r2) qarray-field)
(add (1 r2) (3 r3 qhead-field))
(move (1 r2) (3 r2))
(return)
qemptyp
(compare (3 r3 qcurrlength-field) 0)
(return)
qfullp
(compare
 (3 r3 qcurrlength-field)
 (3 r3 qmaxlength-field))
(return)
end-of-os-source)

Theorem: clean-assembly

'*1*true

Definition: os-symtab

= '((end-of-os-source . 3301)
(qfullp . 3297)
(qemptyp . 3293)
(qfirst . 3280)
(dequeue . 3274)
(qreplace . 3258)
(enqueue . 3240)
(resume-task-trace-label1 . 3238)
(resume-task . 3231)
(svc-resume-task-trace-label1 . 3229)
(svc-resume-task . 3222)
(pc-after-wait . 3222)
(readyq-empty . 3221)
(dispatcher-trace-label2 . 3217)
(dispatcher-trace-label1 . 3211)
(dispatcher . 3206)
(trace-label36 . 3204)

(check-for-empty-output-buffer . 3184)
(trace-label35 . 3184)
(trace-label34 . 3178)
(oih-skip-save-state . 3156)
(trace-label33 . 3156)
(trace-label32 . 3146)
(output-interrupt-handler . 3135)
(trace-label31 . 3133)
(enqueue-input-character . 3128)
(trace-label30 . 3126)
(check-for-iport-error . 3114)
(trace-label29 . 3112)
(check-for-full-input-buffer . 3091)
(trace-label28 . 3091)
(trace-label27 . 3085)
(iih-skip-save-state . 3063)
(trace-label26 . 3063)
(trace-label25 . 3053)
(input-interrupt-handler . 3042)
(trace-label24 . 3025)
(block-tyi . 3020)
(trace-label23 . 3006)
(trace-label22 . 2998)
(trace-label21 . 2986)
(tyi-svc-handler . 2981)
(trace-label20 . 2964)
(block-tyo . 2959)
(trace-label19 . 2951)
(trace-label18 . 2942)
(trace-label17 . 2930)
(tyo-svc-handler . 2922)
(trace-label16 . 2905)
(block-receive . 2900)
(trace-label15 . 2898)
(trace-label14 . 2865)
(trace-label13 . 2853)
(trace-label12 . 2845)
(trace-label11 . 2824)
(receive-svc-handler . 2813)
(trace-label10 . 2796)
(block-send . 2791)
(trace-label9 . 2789)
(trace-label8 . 2756)
(trace-label7 . 2747)

(trace-label6 . 2726)
(send-svc-handler . 2712)
(trace-label5 . 2692)
(svc-interrupt-handler . 2690)
(trace-label4 . 2676)
(trace-label3 . 2669)
(error-interrupt-handler . 2667)
(trace-label2 . 2665)
(trace-label1 . 2656)
(clock-interrupt-handler . 2654)
(restore-state . 2601)
(save-state-return . 2558)
(save-state . 2547)
(mbuffers . 499)
(obuffers . 371)
(ibuffers . 243)
(status-table . 211)
(readyq . 191)
(segment-table . 159)
(task-table . 15)
(temp-r3 . 14)
(temp-r2 . 13)
(current-taskid . 12)
(time-slice . 11)
(branch-address . 10)
(interrupt-data . 8)
(output-new-pc . 7)
(input-new-pc . 6)
(svc-new-pc . 5)
(error-new-pc . 4)
(clock-new-pc . 3)
(reg-save-area . 0)
(taskidlub . 16)
(dest-multiplier . 8)
(source-multiplier . 128)
(message-buffer-length . 8)
(output-buffer-length . 8)
(input-buffer-length . 8)
(input-status . 5)
(output-status . 4)
(receive-status . 3)
(send-status . 2)
(error-status . 1)
(ready-status . 0)

(status-taskid-field . 1)
(status-flag-field . 0)
(status-entry-length . 2)
(limit-field . 1)
(base-field . 0)
(segment-table-length . 32)
(qarray-field . 4)
(qmaxlength-field . 3)
(qcurrlength-field . 2)
(qtail-field . 1)
(qhead-field . 0)
(readyq-length . 20)
(flag-field . 8)
(r7-field . 7)
(r6-field . 6)
(r5-field . 5)
(r4-field . 4)
(r3-field . 3)
(r2-field . 2)
(sp-field . 1)
(pc-field . 0)
(task-table-entry-length . 9)
(task-table-length . 144)
(tyi-svcid . 3)
(tyo-svcid . 2)
(receive-svcid . 1)
(send-svcid . 0)
(charlub . 256)
(output-devid-addr . 9)
(input-char-addr . 9)
(input-devid-addr . 8)
(svcid-addr . 8)
(interrupt-flag-field . 2)
(interrupt-sp-field . 1)
(interrupt-pc-field . 0)
(r7 . 7)
(r6 . 6)
(r5 . 5)
(r4 . 4)
(r3 . 3)
(r2 . 2)
(r1 . 1)
(r0 . 0))

Definition: os-task-table-address = '15 Definition: os-readyq-address = '191 Definition: os-segment-table-address = '159 Definition: os-status-table-address = '211 Definition: os-ibuffers-address = '243 Definition: os-obuffers-address = '371 Definition: os-mbuffers-address = '499 Definition: os-clock-interrupt-handler-address = '2654 Definition: os-error-handler-address = '2667 Definition: os-svc-handler-address = '2690 Definition: os-input-interrupt-handler-address = '3042 Definition: os-output-interrupt-handler-address = '3135 Definition: os-code-address = '2547 Definition: os-save-state-return-address = '2558 Definition: os-dispatcher-return-address = 'nil Definition: os-time-slice-address = '11 Definition: os-code-length = '754 Definition: nthcdr-n-times (n, k, l) = if n ≃ 0 then l

else nthcdr-n-times (n − 1, k, nthcdr (k, l)) endif Definition: firstn-n-times (n, k, l) = if n ≃ 0 then 'nil

else append (firstn (k, l), firstn-n-times (n − 1, k, nthcdr (k, l))) endif Definition: firstn-with-small-recursion (n, l, max) = append (firstn (n mod max, l),

firstn-n-times (n ÷ max, max, nthcdr (n mod max, l)))

Definition: nthcdr-with-small-recursion (n, l, max) = nthcdr (n mod max, nthcdr-n-times (n ÷ max, max, l))

Definition: getseg-with-small-recursion (n, k, l, max) = firstn-with-small-recursion (k,

nthcdr-with-small-recursion (n, l, max), max)

Definition: os-machine-code

= '(2187 13 2 2187 14 3 75 3 191 14 3280 77 2 9 65 2 15
4299 2 0 12747 2 0 4811 2 13 5067 2 14 3275 2 4 3531
2 5 3787 2 6 4043 2 7 65 2 8 20683 2 0 4171 2 13
4171 3 14 0 2123 3 2 77 2 9 65 2 15 77 3 2 65 3 159
218 3 478 3 2123 3 2 65 3 8 6283 0 2 14731 0 2 6795
0 3 63563 7 2 55371 6 2 47179 5 2 38987 4 2 30795 3
2 22603 2 2 0 14 2547 75 3 191 14 3280 14 3274 14
3240 2 3206 14 2547 75 3 191 14 3280 14 3274 77 2 2
65 2 211 203 2 1 459 2 0 2 3206 14 2547 137 8 4 131
8 0 10 2712 131 8 1 10 2813 131 8 2 10 2922 2 2981
2123 6 2 73 6 16 2123 7 3 75 3 191 14 3280 2187 12 2
2123 4 6 77 4 8 2123 3 2 77 3 128 2113 3 4 65 3 499
14 3297 10 2791 2123 2 7 14 3240 2123 3 6 77 3 2 65
3 211 195 3 3 6 3222 4547 3 12 6 3222 203 3 0 459 3
0 2123 2 6 75 3 191 14 3240 2 3222 75 3 191 14 3274
4171 3 12 77 3 2 65 3 211 203 3 2 2507 3 6 2 3206
2123 6 2 73 6 16 75 3 191 14 3280 2187 12 2 2123 4 2
77 4 8 2123 3 6 77 3 128 2113 3 4 65 3 499 14 3293
10 2900 14 3280 14 3274 4171 3 12 77 3 9 65 3 15
3019 3 2 2123 3 6 77 3 2 65 3 211 195 3 2 6 3222
4547 3 12 6 3222 203 3 0 459 3 0 2123 2 6 75 3 191
14 3240 2 3222 75 3 191 14 3274 4171 3 12 77 3 2 65
3 211 203 3 3 2507 3 6 2 3206 2123 7 3 75 3 191 14
3280 2187 12 2 2123 3 2 77 3 8 65 3 371 14 3297 10
2959 2123 2 7 14 3240 182 12 6 3222 166 12 2 3222 75
3 191 14 3274 4171 3 12 77 3 2 65 3 211 203 3 4 459
3 0 2 3206 75 3 191 14 3280 2187 12 2 2123 3 2 77 3
8 65 3 243 14 3293 10 3020 14 3280 14 3274 4171 3 12
77 3 9 65 3 15 3019 3 2 2 3222 75 3 191 14 3274 4171
3 12 77 3 2 65 3 211 203 3 5 459 3 0 2 3206 139 10
3206 2187 14 3 75 3 191 14 3293 10 3063 139 10 3231
4171 3 14 14 2547 4171 5 8 77 5 2 65 5 211 195 5 5 6

      3091 4171 2 8 75 3 191 14 3240 203 5 0 459 5 0 4171
      3 8 77 3 8 65 3 243 14 3297 6 3114 4171 2 9 65 2 256
      14 3258 130 10 178 8 6 3128 4171 2 9 65 2 256 14
      3240 130 10 4171 2 9 14 3240 130 10 139 10 3206 2187
      14 3 75 3 191 14 3293 10 3156 139 10 3231 4171 3 14
      14 2547 4171 5 9 77 5 2 65 5 211 195 5 4 6 3184 4171
      2 9 75 3 191 14 3240 203 5 0 459 5 0 4171 3 9 77 3 8
      65 3 371 14 3293 138 10 14 3280 2191 9 2 14 3274 130
      10 75 3 191 14 3293 10 3221 14 3280 14 2601 186 11
      162 0 4 75 3 191 14 3280 14 2601 174 0 75 3 191 14
      3280 14 2601 162 0 2123 4 3 65 4 4 14401 4 3 2251 4
      2 726 3 31175 3 3 0 14411 4 3 30789 4 3 2113 4 3 65
      4 4 2251 4 2 0 722 3 30919 3 3 0 2123 2 3 65 2 4
      6209 2 3 6219 2 2 0 707 3 0 0 31427 3 3 0)

Definition: os-limit = '3311

Definition: os-task-table (os) = getseg ('15, '144, tm-memory (os))

Definition: os-readyq (os) = getseg ('191, '20, tm-memory (os))

Definition: os-segment-table (os) = getseg ('159, '32, tm-memory (os))

Definition: os-status-table (os) = getseg ('211, '32, tm-memory (os))

Definition: os-ibuffers (os) = getseg ('243, '128, tm-memory (os))

Definition: os-obuffers (os) = getseg ('371, '128, tm-memory (os))

Definition: os-mbuffers (os) = getseg ('499, '2048, tm-memory (os))

Definition: os-code (os) = getseg ('2547, '754, tm-memory (os))

Theorem: length-os-task-table length (os-task-table (os)) = '144

Event: Disable length-os-task-table.

Theorem: plistp-os-task-table plistp (os-task-table (os))

Event: Disable plistp-os-task-table. Theorem: length-os-readyq length (os-readyq (os)) = '20 Event: Disable length-os-readyq. Theorem: plistp-os-readyq plistp (os-readyq (os)) Event: Disable plistp-os-readyq. Theorem: length-os-segment-table length (os-segment-table (os)) = '32 Event: Disable length-os-segment-table. Theorem: plistp-os-segment-table plistp (os-segment-table (os)) Event: Disable plistp-os-segment-table. Theorem: length-os-status-table length (os-status-table (os)) = '32 Event: Disable length-os-status-table. Theorem: plistp-os-status-table plistp (os-status-table (os)) Event: Disable plistp-os-status-table. Theorem: length-os-ibuffers length (os-ibuffers (os)) = '128 Event: Disable length-os-ibuffers. Theorem: plistp-os-ibuffers plistp (os-ibuffers (os)) Event: Disable plistp-os-ibuffers.

Theorem: length-os-obuffers length (os-obuffers (os)) = '128 Event: Disable length-os-obuffers.

Theorem: plistp-os-obuffers plistp (os-obuffers (os)) Event: Disable plistp-os-obuffers.

Theorem: length-os-mbuffers length (os-mbuffers (os)) = '2048 Event: Disable length-os-mbuffers.

Theorem: plistp-os-mbuffers plistp (os-mbuffers (os)) Event: Disable plistp-os-mbuffers.

Definition: os-current-taskid-address = '12 Definition: os-trace-label1 = '2656 Definition: os-trace-label2 = '2665 Definition: os-trace-label3 = '2669 Definition: os-trace-label4 = '2676 Definition: os-trace-label5 = '2692 Definition: os-trace-label6 = '2726 Definition: os-trace-label7 = '2747 Definition: os-trace-label8 = '2756 Definition: os-trace-label9 = '2789 Definition: os-trace-label10 = '2796 Definition: os-svc-receive-handler-address = '2813 Definition: os-trace-label11 = '2824 Definition: os-trace-label12 = '2845 Definition: os-trace-label13 = '2853 Definition: os-trace-label14 = '2865 Definition: os-trace-label15 = '2898 Definition: os-trace-label16 = '2905 Definition: os-svc-tyo-handler-address = '2922 Definition: os-trace-label17 = '2930 Definition: os-trace-label18 = '2942 Definition: os-trace-label19 = '2951 Definition: os-trace-label20 = '2964 Definition: os-svc-tyi-handler-address = '2981 Definition: os-trace-label21 = '2986 Definition: os-trace-label22 = '2998 Definition: os-trace-label23 = '3006 Definition: os-trace-label24 = '3025 Definition: os-trace-label25 = '3053 Definition: os-trace-label26 = '3063 Definition: os-trace-label27 = '3085 Definition: os-trace-label28 = '3091 Definition: os-trace-label29 = '3112 Definition: os-trace-label30 = '3126 Definition: os-trace-label31 = '3133 Definition: os-trace-label32 = '3146 Definition: os-trace-label33 = '3156 Definition: os-trace-label34 = '3178 Definition: os-trace-label35 = '3184 Definition: os-trace-label36 = '3204 Definition: os-dispatcher-trace-label1 = '3211 Definition: os-dispatcher-trace-label2 = '3217 Definition: os-svc-resume-task-address = '3222 Definition: os-svc-resume-task-trace-label1 = '3229 Definition: os-resume-task-address = '3231 Definition: os-resume-task-trace-label1 = '3238 Definition: os-pc-after-wait = '3222 Definition: os-temp-r2-address = '13 Definition: os-temp-r3-address = '14 Definition: os-dispatcher-address = '3206 Definition: os-dispatcher-pc-after-wait = '3222 Definition: os-dispatcher-qemptyp-return-address = '3211 Definition: os-restore-state-address = '2601 Theorem: length-os-code length (os-code (os)) = '754 Event: Disable length-os-code.

Theorem: plistp-os-code plistp (os-code (os)) Event: Disable plistp-os-code.

Definition: finite-number-queuep (queue, capacity, lub) = (array-queuep (queue)

∧ ((getnth ('3, queue) = capacity) ∧ finite-number-listp (getseg ('4, capacity, queue), lub)))

Theorem: array-queuep-finite-number-queue finite-number-queuep (queue, capacity, lub) → array-queuep (queue)

Event: Disable array-queuep-finite-number-queue.

Theorem: finite-number-queue-qmaxlength-field finite-number-queuep (queue, capacity, lub) → (getnth ('3, queue) = capacity)

Event: Disable finite-number-queue-qmaxlength-field.

Theorem: finite-number-listp-qarray finite-number-queuep (queue, capacity, lub) → finite-number-listp (getseg ('4, capacity, queue), lub)

Event: Disable finite-number-listp-qarray.

Theorem: length-finite-number-queue finite-number-queuep (queue, capacity, lub) → (length (queue) = ('4 + capacity))

Theorem: plistp-finite-number-queue finite-number-queuep (queue, capacity, lub) → plistp (queue)

Theorem: finite-number-queue-qhead-size finite-number-queuep (queue, capacity, lub) → ((getnth ('0, queue) ∈ N) ∧ (getnth ('0, queue) < capacity))

Event: Disable finite-number-queue-qhead-size.

Theorem: finite-number-queue-qtail-size finite-number-queuep (queue, capacity, lub) → ((getnth ('1, queue) ∈ N) ∧ (getnth ('1, queue) < capacity))

Event: Disable finite-number-queue-qtail-size.

Theorem: finite-number-queue-qcurrlength-size finite-number-queuep (queue, capacity, lub) → ((getnth ('2, queue) ∈ N) ∧ (getnth ('2, queue) < (1 + capacity)))

Event: Disable finite-number-queue-qcurrlength-size.

Theorem: finite-number-queue-qmaxlength-value finite-number-queuep (queue, capacity, lub) → (getnth ('3, queue) = capacity)

Event: Disable finite-number-queue-qmaxlength-value.

Theorem: finite-number-queue-qarray-after-enq finite-number-queuep (queue, capacity, lub) → (getseg ('4, capacity, array-enq (item, queue))

= putnth (item, getnth ('1, queue), getseg ('4, capacity, queue)))

Event: Disable finite-number-queue-qarray-after-enq.

Theorem: finite-number-queuep-array-enq (finite-number-queuep (queue, capacity, lub) ∧ ((¬ array-qfullp (queue)) ∧ finite-numberp (item, lub))) → finite-number-queuep (array-enq (item, queue), capacity, lub)

Event: Disable finite-number-queuep-array-enq.

Theorem: finite-number-queue-qarray-after-deq finite-number-queuep (queue, capacity, lub) → (getseg ('4, capacity, array-deq (queue)) = getseg ('4, capacity, queue))

Event: Disable finite-number-queue-qarray-after-deq.

Theorem: finite-number-queuep-array-deq (finite-number-queuep (queue, capacity, lub) ∧ (¬ array-qemptyp (queue))) → finite-number-queuep (array-deq (queue), capacity, lub)

Event: Disable finite-number-queuep-array-deq.

Theorem: array-qfirst-finite-number-queue (finite-number-queuep (queue, capacity, lub) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) ∈ N) ∧ (array-qfirst (queue) < lub))

Event: Disable array-qfirst-finite-number-queue.

Theorem: remainder-array-qfirst-finite-number-queue (finite-number-queuep (queue, capacity, lub) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) mod lub) = array-qfirst (queue))

Event: Disable remainder-array-qfirst-finite-number-queue.

Event: Let us define the theory finite-number-queuep-facts to consist of the following events: finite-number-queue-qmaxlength-value, finite-number-queue-qcurrlength-size, finite-number-queue-qtail-size, finite-number-queue-qhead-size, remainder-array-qfirst-finite-number-queue, array-qfirst-finite-number-queue, finitenumber-queuep-array-deq, finite-number-queue-qarray-after-deq, finite-number-queuep-array-enq, finite-number-queue-qarray-after-enq, plistp-finite-number-queue, length-finite-number-queue, finite-number-listp-qarray, finite-number-queue-qmaxlength-field, array-queuep-finite-number-queue.

Definition: finite-number-queue-listp (list, capacity, lub) = if listp (list)

then finite-number-queuep (car (list), capacity, lub)

∧ finite-number-queue-listp (cdr (list), capacity, lub) else '*1*true endif

Theorem: finite-number-queuep-getnth (finite-number-queue-listp (l, capacity, lub) ∧ (i < length (l))) → finite-number-queuep (getnth (i, l), capacity, lub)

Event: Disable finite-number-queuep-getnth.

Theorem: finite-number-queue-listp-putnth (finite-number-queue-listp (l, capacity, lub) ∧ finite-number-queuep (queue, capacity, lub)) → finite-number-queue-listp (putnth (queue, i, l), capacity, lub)

Event: Disable finite-number-queue-listp-putnth.

Definition: finite-number-queue-tablep (n, l, capacity, lub) = if listp (l)

then plistp (car (l))

∧ ((length (car (l)) = n)

∧ (finite-number-queue-listp (car (l), capacity, lub)

∧ finite-number-queue-tablep (n, cdr (l), capacity, lub)))

else '*1*true endif Theorem: finite-number-queue-listp-getnth (finite-number-queue-tablep (n, l, capacity, lub) ∧ (i < length (l))) → (plistp (getnth (i, l))

∧ ((length (getnth (i, l)) = n) ∧ finite-number-queue-listp (getnth (i, l), capacity, lub)))

Event: Disable finite-number-queue-listp-getnth.

Theorem: finite-number-queuep-getnth2 (finite-number-queue-tablep (n, l, capacity, lub) ∧ ((i < length (l)) ∧ (j < n))) → finite-number-queuep (getnth2 (i, j , l), capacity, lub)

Event: Disable finite-number-queuep-getnth2.

Theorem: finite-number-queue-tablep-putnth (finite-number-queue-tablep (n, l, capacity, lub) ∧ (finite-number-queue-listp (s, capacity, lub)

∧ (plistp (s) ∧ (length (s) = n)))) → finite-number-queue-tablep (n, putnth (s, i, l), capacity, lub)

Event: Disable finite-number-queue-tablep-putnth.

Theorem: finite-number-queue-tablep-putnth2 (finite-number-queue-tablep (n, l, capacity, lub) ∧ ((i < length (l)) ∧ finite-number-queuep (queue, capacity, lub))) → finite-number-queue-tablep (n, putnth2 (queue, i, j , l), capacity, lub)

Event: Disable finite-number-queue-tablep-putnth2.

Theorem: finite-number-queue-listp-nthcdr finite-number-queue-listp (l, capacity, lub) → finite-number-queue-listp (nthcdr (n, l), capacity, lub)

Event: Disable finite-number-queue-listp-nthcdr.

Theorem: finite-number-queue-listp-firstn finite-number-queue-listp (l, capacity, lub) → finite-number-queue-listp (firstn (n, l), capacity, lub)

Event: Disable finite-number-queue-listp-firstn.

Theorem: finite-number-queue-listp-getseg (if length (l) < (n + k) then '*1*false else '*1*true endif ∧ finite-number-queue-listp (l, capacity, lub)) → finite-number-queue-listp (getseg (n, k, l), capacity, lub)

Event: Disable finite-number-queue-listp-getseg.

Theorem: divisor-not-lessp ((n ≄ 0) ∧ ((a ≄ 0) ∧ divides (n, a))) → (a ≮ n)

Theorem: divides-not-lessp-instance ((n ≄ 0) ∧ (listp (l) ∧ ((length (l) mod n) = '0))) → ((length (l) < n) = '*1*false)

Event: Disable divides-not-lessp-instance.

Theorem: finite-number-queue-tablep-table ((n ≄ 0) ∧ (((length (l) mod n) = '0)

∧ finite-number-queue-listp (l, capacity, lub))) → finite-number-queue-tablep (n, table (n, l), capacity, lub)

Event: Disable finite-number-queue-tablep-table.

Definition: os-current-taskid (os) = array-qfirst (os-readyq (os))

Definition: os-ready-set (os) = index-ready-set ('0, table ('2, os-status-table (os)))

Definition: os-readyq-qarray (os) = getseg ('4, getnth ('3, os-readyq (os)), os-readyq (os))

(DEFN GOOD-OS
 (OS)
 (AND
  (GOOD-TM OS)
  (AND
   (EQUAL (TM-SLIMIT OS) '3311)
   (AND
    (EQUAL (OS-CODE OS)

'(2187 13 2 2187 14 3 75 3 191 14 3280 77 2 9 65 2 15 4299 2 0
12747 2 0 4811 2 13 5067 2 14 3275 2 4 3531 2 5 3787 2 6
4043 2 7 65 2 8 20683 2 0 4171 2 13 4171 3 14 0 2123 3 2 77
2 9 65 2 15 77 3 2 65 3 159 218 3 478 3 2123 3 2 65 3 8
6283 0 2 14731 0 2 6795 0 3 63563 7 2 55371 6 2 47179 5 2
38987 4 2 30795 3 2 22603 2 2 0 14 2547 75 3 191 14 3280 14
3274 14 3240 2 3206 14 2547 75 3 191 14 3280 14 3274 77 2 2
65 2 211 203 2 1 459 2 0 2 3206 14 2547 137 8 4 131 8 0 10
2712 131 8 1 10 2813 131 8 2 10 2922 2 2981 2123 6 2 73 6
16 2123 7 3 75 3 191 14 3280 2187 12 2 2123 4 6 77 4 8 2123
3 2 77 3 128 2113 3 4 65 3 499 14 3297 10 2791 2123 2 7 14
3240 2123 3 6 77 3 2 65 3 211 195 3 3 6 3222 4547 3 12 6
3222 203 3 0 459 3 0 2123 2 6 75 3 191 14 3240 2 3222 75 3
191 14 3274 4171 3 12 77 3 2 65 3 211 203 3 2 2507 3 6 2
3206 2123 6 2 73 6 16 75 3 191 14 3280 2187 12 2 2123 4 2
77 4 8 2123 3 6 77 3 128 2113 3 4 65 3 499 14 3293 10 2900
14 3280 14 3274 4171 3 12 77 3 9 65 3 15 3019 3 2 2123 3 6
77 3 2 65 3 211 195 3 2 6 3222 4547 3 12 6 3222 203 3 0 459
3 0 2123 2 6 75 3 191 14 3240 2 3222 75 3 191 14 3274 4171
3 12 77 3 2 65 3 211 203 3 3 2507 3 6 2 3206 2123 7 3 75 3
191 14 3280 2187 12 2 2123 3 2 77 3 8 65 3 371 14 3297 10
2959 2123 2 7 14 3240 182 12 6 3222 166 12 2 3222 75 3 191
14 3274 4171 3 12 77 3 2 65 3 211 203 3 4 459 3 0 2 3206 75
3 191 14 3280 2187 12 2 2123 3 2 77 3 8 65 3 243 14 3293 10
3020 14 3280 14 3274 4171 3 12 77 3 9 65 3 15 3019 3 2 2
3222 75 3 191 14 3274 4171 3 12 77 3 2 65 3 211 203 3 5 459
3 0 2 3206 139 10 3206 2187 14 3 75 3 191 14 3293 10 3063
139 10 3231 4171 3 14 14 2547 4171 5 8 77 5 2 65 5 211 195
5 5 6 3091 4171 2 8 75 3 191 14 3240 203 5 0 459 5 0 4171 3
8 77 3 8 65 3 243 14 3297 6 3114 4171 2 9 65 2 256 14 3258
130 10 178 8 6 3128 4171 2 9 65 2 256 14 3240 130 10 4171 2
9 14 3240 130 10 139 10 3206 2187 14 3 75 3 191 14 3293 10
3156 139 10 3231 4171 3 14 14 2547 4171 5 9 77 5 2 65 5 211
195 5 4 6 3184 4171 2 9 75 3 191 14 3240 203 5 0 459 5 0
4171 3 9 77 3 8 65 3 371 14 3293 138 10 14 3280 2191 9 2 14
3274 130 10 75 3 191 14 3293 10 3221 14 3280 14 2601 186 11
162 0 4 75 3 191 14 3280 14 2601 174 0 75 3 191 14 3280 14
2601 162 0 2123 4 3 65 4 4 14401 4 3 2251 4 2 726 3 31175 3
3 0 14411 4 3 30789 4 3 2113 4 3 65 4 4 2251 4 2 0 722 3
30919 3 3 0 2123 2 3 65 2 4 6209 2 3 6219 2 2 0 707 3 0 0
31427 3 3 0))
(AND
(EQUAL (GETNTH '3 (TM-MEMORY OS))
'2654)

(AND
(EQUAL (GETNTH '4 (TM-MEMORY OS))
'2667)
(AND
(EQUAL (GETNTH '5 (TM-MEMORY OS))
 '2690)
(AND
(EQUAL (GETNTH '6 (TM-MEMORY OS))
  '3042)
(AND
(EQUAL (GETNTH '7 (TM-MEMORY OS))
   '3135)
(AND
(EQUAL (GETNTH '11 (TM-MEMORY OS))
    '1000)
(AND
(NOT (TM-IN-SUPERVISOR-MODE OS))
(AND
(GOOD-CPU-LIST (TABLE '9 (OS-TASK-TABLE OS)))
(AND
(GOOD-STATUS-LIST (TABLE '2 (OS-STATUS-TABLE OS)))
(AND
 (FINITE-NUMBER-QUEUEP (OS-READYQ OS)
                       '16
                       '16)
 (AND
  (MUTUALLY-DISJOINT (TABLE '2 (OS-SEGMENT-TABLE OS)))
  (AND
   (DISJOINT-EVERYWHERE '0
                        '3311
                        (TABLE '2 (OS-SEGMENT-TABLE OS)))
   (AND
    (FINITE-SEGMENT-TABLEP (TABLE '2 (OS-SEGMENT-TABLE OS))
                           '65536)
    (AND
     (FINITE-NUMBER-QUEUE-LISTP (TABLE '8 (OS-IBUFFERS OS))
                                '4
                                '65536)
     (AND
      (FINITE-NUMBER-QUEUE-LISTP (TABLE '8 (OS-OBUFFERS OS))
                                 '4
                                 '65536)
      (AND
       (FINITE-NUMBER-QUEUE-LISTP (TABLE '8 (OS-MBUFFERS OS))

                                    '65536)
         (AND
          (PERMUTATION (MAPUP-QUEUE (OS-READYQ OS))
                       (OS-READY-SET OS))
          (AND
           (IFF (TM-WAITING OS)
                (ARRAY-QEMPTYP (OS-READYQ OS)))
           (IMPLIES
            (NOT (TM-WAITING OS))
            (AND
             (EQUAL
                  (TM-BASE OS)
                  (BASE (GETNTH (OS-CURRENT-TASKID OS)
                                (TABLE '2 (OS-SEGMENT-TABLE OS)))))
             (EQUAL
              (TM-LIMIT OS)
              (LIMIT
               (GETNTH
                (OS-CURRENT-TASKID OS)
                (TABLE '2
                    (OS-SEGMENT-TABLE OS))))))))))))))))))))))))))))
NIL)

Theorem: good-tm-os good-os (os) → good-tm (os)

Event: Disable good-tm-os.

Theorem: tm-slimit-os good-os (os) → (tm-slimit (os) = '3311)

Event: Disable tm-slimit-os.

Theorem: os-code-os good-os (os) → (os-code (os)

= '(2187 13 2 2187 14 3 75 3 191 14 3280 77 2 9 65
2 15 4299 2 0 12747 2 0 4811 2 13 5067 2 14
3275 2 4 3531 2 5 3787 2 6 4043 2 7 65 2 8
20683 2 0 4171 2 13 4171 3 14 0 2123 3 2 77 2
9 65 2 15 77 3 2 65 3 159 218 3 478 3 2123 3
2 65 3 8 6283 0 2 14731 0 2 6795 0 3 63563 7
2 55371 6 2 47179 5 2 38987 4 2 30795 3 2

22603 2 2 0 14 2547 75 3 191 14 3280 14 3274
14 3240 2 3206 14 2547 75 3 191 14 3280 14
3274 77 2 2 65 2 211 203 2 1 459 2 0 2 3206 14
2547 137 8 4 131 8 0 10 2712 131 8 1 10 2813
131 8 2 10 2922 2 2981 2123 6 2 73 6 16 2123
7 3 75 3 191 14 3280 2187 12 2 2123 4 6 77 4
8 2123 3 2 77 3 128 2113 3 4 65 3 499 14 3297
10 2791 2123 2 7 14 3240 2123 3 6 77 3 2 65 3
211 195 3 3 6 3222 4547 3 12 6 3222 203 3 0
459 3 0 2123 2 6 75 3 191 14 3240 2 3222 75 3
191 14 3274 4171 3 12 77 3 2 65 3 211 203 3 2
2507 3 6 2 3206 2123 6 2 73 6 16 75 3 191 14
3280 2187 12 2 2123 4 2 77 4 8 2123 3 6 77 3
128 2113 3 4 65 3 499 14 3293 10 2900 14 3280
14 3274 4171 3 12 77 3 9 65 3 15 3019 3 2 2123
3 6 77 3 2 65 3 211 195 3 2 6 3222 4547 3 12
6 3222 203 3 0 459 3 0 2123 2 6 75 3 191 14
3240 2 3222 75 3 191 14 3274 4171 3 12 77 3 2
65 3 211 203 3 3 2507 3 6 2 3206 2123 7 3 75
3 191 14 3280 2187 12 2 2123 3 2 77 3 8 65 3
371 14 3297 10 2959 2123 2 7 14 3240 182 12 6
3222 166 12 2 3222 75 3 191 14 3274 4171 3 12
77 3 2 65 3 211 203 3 4 459 3 0 2 3206 75 3
191 14 3280 2187 12 2 2123 3 2 77 3 8 65 3 243
14 3293 10 3020 14 3280 14 3274 4171 3 12 77
3 9 65 3 15 3019 3 2 2 3222 75 3 191 14 3274
4171 3 12 77 3 2 65 3 211 203 3 5 459 3 0 2
3206 139 10 3206 2187 14 3 75 3 191 14 3293 10
3063 139 10 3231 4171 3 14 14 2547 4171 5 8 77
5 2 65 5 211 195 5 5 6 3091 4171 2 8 75 3 191
14 3240 203 5 0 459 5 0 4171 3 8 77 3 8 65 3
243 14 3297 6 3114 4171 2 9 65 2 256 14 3258
130 10 178 8 6 3128 4171 2 9 65 2 256 14 3240
130 10 4171 2 9 14 3240 130 10 139 10 3206
2187 14 3 75 3 191 14 3293 10 3156 139 10 3231
4171 3 14 14 2547 4171 5 9 77 5 2 65 5 211 195
5 4 6 3184 4171 2 9 75 3 191 14 3240 203 5 0
459 5 0 4171 3 9 77 3 8 65 3 371 14 3293 138
10 14 3280 2191 9 2 14 3274 130 10 75 3 191 14
3293 10 3221 14 3280 14 2601 186 11 162 0 4 75
3 191 14 3280 14 2601 174 0 75 3 191 14 3280
14 2601 162 0 2123 4 3 65 4 4 14401 4 3 2251
4 2 726 3 31175 3 3 0 14411 4 3 30789 4 3 2113
4 3 65 4 4 2251 4 2 0 722 3 30919 3 3 0 2123

           2 3 65 2 4 6209 2 3 6219 2 2 0 707 3 0 0 31427
           3 3 0))

Event: Disable os-code-os.

Theorem: os-clock-new-pc good-os (os) → (getnth ('3, tm-memory (os)) = '2654)

Event: Disable os-clock-new-pc.

Theorem: os-error-new-pc good-os (os) → (getnth ('4, tm-memory (os)) = '2667)

Event: Disable os-error-new-pc.

Theorem: os-svc-new-pc good-os (os) → (getnth ('5, tm-memory (os)) = '2690)

Event: Disable os-svc-new-pc.

Theorem: os-input-new-pc good-os (os) → (getnth ('6, tm-memory (os)) = '3042)

Event: Disable os-input-new-pc.

Theorem: os-output-new-pc good-os (os) → (getnth ('7, tm-memory (os)) = '3135)

Event: Disable os-output-new-pc.

Theorem: os-time-slice good-os (os) → (getnth ('11, tm-memory (os)) = '1000)

Event: Disable os-time-slice.

Theorem: os-not-in-supervisor-mode good-os (os) → (¬ tm-in-supervisor-mode (os))

Event: Disable os-not-in-supervisor-mode.

Theorem: tm-base-os (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-base (os)

= base (getnth (os-current-taskid (os), table ('2, os-segment-table (os)))))

Event: Disable tm-base-os.

Theorem: tm-limit-os (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-limit (os)

= limit (getnth (os-current-taskid (os), table ('2, os-segment-table (os)))))

Event: Disable tm-limit-os.

Theorem: good-cpu-list-os-task-table good-os (os) → good-cpu-list (table ('9, os-task-table (os)))

Event: Disable good-cpu-list-os-task-table.

Theorem: good-status-list-os-status-table good-os (os) → good-status-list (table ('2, os-status-table (os)))

Event: Disable good-status-list-os-status-table.

Theorem: finite-number-queuep-os-readyq good-os (os) → finite-number-queuep (os-readyq (os), '16, '16)

Event: Disable finite-number-queuep-os-readyq.

Theorem: mutually-disjoint-os-segment-table good-os (os) → mutually-disjoint (table ('2, os-segment-table (os)))

Event: Disable mutually-disjoint-os-segment-table.

Theorem: disjoint-everywhere-os-segment-table good-os (os) → disjoint-everywhere ('0, '3311, table ('2, os-segment-table (os)))

Event: Disable disjoint-everywhere-os-segment-table.

Theorem: finite-segment-tablep-os-segment-table good-os (os) → finite-segment-tablep (table ('2, os-segment-table (os)), '65536)

Event: Disable finite-segment-tablep-os-segment-table.

Theorem: finite-number-queue-listp-os-ibuffers good-os (os) → finite-number-queue-listp (table ('8, os-ibuffers (os)), '4, '65536)

Event: Disable finite-number-queue-listp-os-ibuffers.

Theorem: finite-number-queue-listp-os-obuffers good-os (os) → finite-number-queue-listp (table ('8, os-obuffers (os)), '4, '65536)

Event: Disable finite-number-queue-listp-os-obuffers.

Theorem: finite-number-queue-listp-os-mbuffers good-os (os) → finite-number-queue-listp (table ('8, os-mbuffers (os)), '4, '65536)

Event: Disable finite-number-queue-listp-os-mbuffers.

Theorem: finite-number-queue-tablep-os-mbuffers good-os (os) → finite-number-queue-tablep ('16,

table ('16, table ('8, os-mbuffers (os))),

                            '4,
                            '65536)

Event: Disable finite-number-queue-tablep-os-mbuffers.

Theorem: permutation-os-readyq-qarray-os-ready-set good-os (os) → permutation (mapup-queue (os-readyq (os)), os-ready-set (os))

Event: Disable permutation-os-readyq-qarray-os-ready-set.

Theorem: tm-waiting-iff-array-qemptyp-os-readyq good-os (os) → (tm-waiting (os) ↔ array-qemptyp (os-readyq (os)))

Event: Disable tm-waiting-iff-array-qemptyp-os-readyq.

Definition: os-taskid (os) = array-qfirst (os-readyq (os))

Theorem: finite-numberp-os-taskid (good-os (os) ∧ (¬ tm-waiting (os))) → finite-numberp (os-taskid (os), '16)

Event: Disable finite-numberp-os-taskid.

Event: Let us define the theory good-os-properties to consist of the following events: finite-numberp-os-taskid, tm-waiting-iff-array-qemptyp-os-readyq, permutation-os-readyq-qarray-os-ready-set, finite-number-queue-tablep-os-mbuffers, finite-number-queue-listp-os-mbuffers, finite-number-queue-listp-os-obuffers, finitenumber-queue-listp-os-ibuffers, finite-segment-tablep-os-segment-table, disjointeverywhere-os-segment-table, mutually-disjoint-os-segment-table, finite-number-queuep-os-readyq, good-status-list-os-status-table, good-cpu-list-os-task-table, tm-limit-os, tm-base-os, os-not-in-supervisor-mode, os-time-slice, os-output-new-pc, os-input-new-pc, os-svc-new-pc, os-error-new-pc, os-clock-new-pc, os-code-os, tm-slimit-os, good-tm-os.

Theorem: length-finite-number-queue-corollary finite-number-queuep (queue, '16, '16) → (length (queue) = '20)

Event: Disable length-finite-number-queue-corollary.

Theorem: plistp-finite-number-queue-corollary finite-number-queuep (queue, '16, '16) → plistp (queue)

Event: Disable plistp-finite-number-queue-corollary.

Theorem: array-queuep-finite-number-queue-corollary finite-number-queuep (queue, '16, '16) → array-queuep (queue)

Event: Disable array-queuep-finite-number-queue-corollary.

Theorem: finite-number-queue-qhead-size-corollary finite-number-queuep (queue, '16, '16) → ((getnth ('0, queue) ∈ N) ∧ (getnth ('0, queue) < '16))

Event: Disable finite-number-queue-qhead-size-corollary.

Theorem: finite-number-queue-qtail-size-corollary finite-number-queuep (queue, '16, '16) → ((getnth ('1, queue) ∈ N) ∧ (getnth ('1, queue) < '16))

Event: Disable finite-number-queue-qtail-size-corollary.

Theorem: finite-number-queue-qcurrlength-size-corollary finite-number-queuep (queue, '16, '16) → ((getnth ('2, queue) ∈ N) ∧ (getnth ('2, queue) < '17))

Event: Disable finite-number-queue-qcurrlength-size-corollary.

Theorem: finite-number-queue-qmaxlength-value-corollary finite-number-queuep (queue, '16, '16) → (getnth ('3, queue) = '16)

Event: Disable finite-number-queue-qmaxlength-value-corollary.

Theorem: finite-number-queuep-array-enq-finite-number-queue-corollary (finite-number-queuep (queue, '16, '16) ∧ ((¬ array-qfullp (queue)) ∧ ((item ∈ N) ∧ (item < '16)))) → finite-number-queuep (array-enq (item, queue), '16, '16)

Event: Disable finite-number-queuep-array-enq-finite-number-queue-corollary.

Theorem: finite-number-queuep-array-deq-finite-number-queue-corollary (finite-number-queuep (queue, '16, '16) ∧ (¬ array-qemptyp (queue))) → finite-number-queuep (array-deq (queue), '16, '16)

Event: Disable finite-number-queuep-array-deq-finite-number-queue-corollary.

Theorem: array-qfirst-finite-number-queue-corollary (finite-number-queuep (queue, '16, '16) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) ∈ N) ∧ (array-qfirst (queue) < '16))

Event: Disable array-qfirst-finite-number-queue-corollary.

Theorem: remainder-array-qfirst-finite-number-queue-corollary (finite-number-queuep (queue, '16, '16) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) mod '16) = array-qfirst (queue))

Event: Disable remainder-array-qfirst-finite-number-queue-corollary.

Event: Let us define the theory finite-number-queue-corollaries to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary, array-qfirst-finite-number-queue-corollary, finite-number-queuep-array-deq-finite-number-queue-corollary, finite-number-queuep-array-enq-finite-number-queue-corollary, finite-number-queue-qmaxlength-value-corollary, finite-number-queue-qcurrlength-size-corollary, finite-number-queue-qtail-size-corollary, finite-number-queue-qhead-size-corollary, array-queuep-finite-number-queue-corollary, plistp-finite-number-queue-corollary, length-finite-number-queue-corollary.

Theorem: length-finite-number-queue-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → (length (queue) = '8)

Event: Disable length-finite-number-queue-corollary-for-mbuffers.

Theorem: plistp-finite-number-queue-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → plistp (queue)

Event: Disable plistp-finite-number-queue-corollary-for-mbuffers.

Theorem: array-queuep-finite-number-queue-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → array-queuep (queue)

Event: Disable array-queuep-finite-number-queue-corollary-for-mbuffers.

Theorem: finite-number-queue-qhead-size-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('0, queue) ∈ N) ∧ (getnth ('0, queue) < '4))

Event: Disable finite-number-queue-qhead-size-corollary-for-mbuffers.

Theorem: finite-number-queue-qtail-size-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('1, queue) ∈ N) ∧ (getnth ('1, queue) < '4))

Event: Disable finite-number-queue-qtail-size-corollary-for-mbuffers.

Theorem: finite-number-queue-qcurrlength-size-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('2, queue) ∈ N) ∧ (getnth ('2, queue) < '5))

Event: Disable finite-number-queue-qcurrlength-size-corollary-for-mbuffers.

Theorem: finite-number-queue-qmaxlength-value-corollary-for-mbuffers finite-number-queuep (queue, '4, '65536) → (getnth ('3, queue) = '4)

Event: Disable finite-number-queue-qmaxlength-value-corollary-for-mbuffers.

Theorem: finite-number-queuep-array-enq-finite-number-queue-corollary-for-mbuffers (finite-number-queuep (queue, '4, '65536) ∧ ((¬ array-qfullp (queue)) ∧ ((item ∈ N) ∧ (item < '65536)))) → finite-number-queuep (array-enq (item, queue), '4, '65536)

Event: Disable finite-number-queuep-array-enq-finite-number-queue-corollary-for-mbuffers.

Theorem: finite-number-queuep-array-deq-finite-number-queue-corollary-for-mbuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → finite-number-queuep (array-deq (queue), '4, '65536)

Event: Disable finite-number-queuep-array-deq-finite-number-queue-corollary-for-mbuffers.

Theorem: array-qfirst-finite-number-queue-corollary-for-mbuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) ∈ N) ∧ (array-qfirst (queue) < '65536))

Event: Disable array-qfirst-finite-number-queue-corollary-for-mbuffers.

Theorem: remainder-array-qfirst-finite-number-queue-corollary-for-mbuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) mod '65536) = array-qfirst (queue))

Event: Disable remainder-array-qfirst-finite-number-queue-corollary-for-mbuffers.

Theorem: finite-number-queue-listp-getnth-corollary (finite-number-queue-tablep ('16, l, '4, '65536) ∧ (i < length (l))) → (plistp (getnth (i, l))

∧ ((length (getnth (i, l)) = '16) ∧ finite-number-queue-listp (getnth (i, l), '4, '65536)))

Event: Disable finite-number-queue-listp-getnth-corollary.

Theorem: finite-number-queuep-getnth2-corollary (finite-number-queue-tablep ('16, l, '4, '65536) ∧ ((i < length (l)) ∧ (j < '16))) → finite-number-queuep (getnth2 (i, j , l), '4, '65536)

Event: Disable finite-number-queuep-getnth2-corollary.

Theorem: finite-number-queue-tablep-putnth-corollary (finite-number-queue-tablep ('16, l, '4, '65536) ∧ (finite-number-queue-listp (s, '4, '65536)

∧ (plistp (s) ∧ (length (s) = '16)))) → finite-number-queue-tablep ('16, putnth (s, i, l), '4, '65536)

Event: Disable finite-number-queue-tablep-putnth-corollary.

Theorem: finite-number-queue-tablep-putnth2-corollary (finite-number-queue-tablep ('16, l, '4, '65536) ∧ ((i < length (l)) ∧ finite-number-queuep (queue, '4, '65536))) → finite-number-queue-tablep ('16, putnth2 (queue, i, j , l), '4, '65536)

Event: Disable finite-number-queue-tablep-putnth2-corollary.

Event: Let us define the theory finite-number-queue-tablep-corollaries to consist of the following events: finite-number-queue-tablep-putnth2-corollary, finitenumber-queue-tablep-putnth-corollary, finite-number-queuep-getnth2-corollary, finite-number-queue-listp-getnth-corollary, remainder-array-qfirst-finite-number-queue-corollary-for-mbuffers, array-qfirst-finite-number-queue-corollary-for-mbuffers, finite-number-queuep-array-deq-finite-number-queue-corollary-for-mbuffers, finitenumber-queuep-array-enq-finite-number-queue-corollary-for-mbuffers, finite-number-queue-qmaxlength-value-corollary-for-mbuffers, finite-number-queue-qcurrlength-size-corollary-for-mbuffers, finite-number-queue-qtail-size-corollary-for-mbuffers, finite-number-queue-qhead-size-corollary-for-mbuffers, array-queuep-finite-number-queue-corollary-for-mbuffers, plistp-finite-number-queue-corollary-for-mbuffers, length-finite-number-queue-corollary-for-mbuffers.

Theorem: number-of-ready-tasks-equals-length-os-readyq permutation (mapup-queue (os-readyq (os)), os-ready-set (os)) → (number-of-ready-tasks (table ('2, os-status-table (os)))

= length (mapup-queue (os-readyq (os))))

Event: Disable number-of-ready-tasks-equals-length-os-readyq.

Theorem: os-waiting-to-sendp-implies-readyq-not-full (good-os (os) ∧ ((getnth ('2 ∗ destid, os-status-table (os)) = '2)

∧ finite-numberp (destid, '16))) → (¬ array-qfullp (os-readyq (os)))

Theorem: os-waiting-to-receivep-implies-readyq-not-full (good-os (os)

∧ ((getnth ('2 ∗ destid, os-status-table (os)) = '3)

∧ finite-numberp (destid, '16))) → (¬ array-qfullp (os-readyq (os)))

Theorem: os-waiting-to-inputp-implies-readyq-not-full (good-os (os) ∧ ((getnth ('2 ∗ destid, os-status-table (os)) = '5)

∧ finite-numberp (destid, '16))) → (¬ array-qfullp (os-readyq (os)))

Theorem: os-waiting-to-outputp-implies-readyq-not-full (good-os (os) ∧ ((getnth ('2 ∗ destid, os-status-table (os)) = '4)

∧ finite-numberp (destid, '16))) → (¬ array-qfullp (os-readyq (os)))

Theorem: finite-number-queue-qarray-after-qreplace finite-number-queuep (queue, capacity, lub) → (getseg ('4, capacity, array-qreplace (item, queue))

= putnth (item, decr-mod (getnth ('1, queue), getnth ('3, queue)), getseg ('4, capacity, queue)))

Theorem: finite-number-queuep-array-qreplace (finite-number-queuep (queue, capacity, lub) ∧ ((¬ array-qemptyp (queue)) ∧ finite-numberp (item, lub))) → finite-number-queuep (array-qreplace (item, queue), capacity, lub)

Event: Disable finite-number-queuep-array-qreplace.

Theorem: permutation-os-readyq-qarray-os-ready-set-corollary good-os (os) → permutation (mapup-queue (os-readyq (os)),

index-ready-set ('0, table ('2, os-status-table (os))))

Event: Disable permutation-os-readyq-qarray-os-ready-set-corollary.

Definition: mapup-cpu (taskid, os) = if tm-waiting (os) then getnth (taskid, table ('9, os-task-table (os)))

elseif taskid = os-current-taskid (os) then tm-cpu (os) else getnth (taskid, table ('9, os-task-table (os))) endif

Definition: mapup-regs (taskid, os) = getseg ('0, '8, mapup-cpu (taskid, os))

Definition: mapup-cc (taskid, os) = tm-unpack-cc (getnth ('8, mapup-cpu (taskid, os)))

Definition: mapup-error (taskid, os) = tm-unpack-error (getnth ('8, mapup-cpu (taskid, os)))

Definition: mapup-svcflag (taskid, os) = tm-unpack-svcflag (getnth ('8, mapup-cpu (taskid, os)))

Definition: mapup-svcid (taskid, os) = tm-unpack-svcid (getnth ('8, mapup-cpu (taskid, os)))

Definition: mapup-base (taskid, os) = base (getnth (taskid, table ('2, os-segment-table (os))))

Definition: mapup-limit (taskid, os) = limit (getnth (taskid, table ('2, os-segment-table (os))))

Definition: mapup-task (taskid, os) = mapup-address-space (tm-memory (os),

mapup-regs (taskid, os), mapup-cc (taskid, os), mapup-error (taskid, os), mapup-svcflag (taskid, os), mapup-svcid (taskid, os), mapup-base (taskid, os), mapup-limit (taskid, os))

Definition: mapup-tasks (taskid, os) = if taskid < '16

then cons (mapup-task (taskid, os), mapup-tasks (1 + taskid, os))

else 'nil endif

Definition: mapup-os-tasks (os) = mapup-tasks ('0, os)

Definition: mapup-queue-list (l) = if listp (l) then cons (mapup-queue (car (l)), mapup-queue-list (cdr (l)))

else 'nil endif Definition: mapup-os-ibuffers (os) = mapup-queue-list (table ('8, os-ibuffers (os)))

Definition: mapup-os-obuffers (os) = mapup-queue-list (table ('8, os-obuffers (os)))

Definition: mapup-os-mbuffers (os) = table ('16, mapup-queue-list (table ('8, os-mbuffers (os))))

Definition: mapup-os (os) = ak (mapup-os-tasks (os),

mapup-os-ibuffers (os), mapup-os-obuffers (os), mapup-os-mbuffers (os), mapup-queue (os-readyq (os)), table ('2, os-status-table (os)), tm-rwstate (os), tm-clock (os), tm-iports (os), tm-oports (os))

Theorem: length-mapup-queue-list length (mapup-queue-list (l)) = length (l)

Event: Disable length-mapup-queue-list.

Theorem: getnth-mapup-queue-list (i < length (l)) → (getnth (i, mapup-queue-list (l)) = mapup-queue (getnth (i, l)))

Event: Disable getnth-mapup-queue-list.

Theorem: mapup-queue-list-putnth mapup-queue-list (putnth (v, i, l)) = putnth (mapup-queue (v), i, mapup-queue-list (l))

Event: Disable mapup-queue-list-putnth.

Theorem: mapup-queue-getnth (finite-number-queue-listp (l, capacity, lub) ∧ (id < length (l))) → (mapup-queue (getnth (id, l)) = getnth (id, mapup-queue-list (l)))

Event: Disable mapup-queue-getnth.

Theorem: length-mapup-tasks length (mapup-tasks (taskid, os)) = ('16 − taskid)

Event: Disable length-mapup-tasks.

Theorem: length-mapup-os-tasks length (mapup-os-tasks (os)) = '16

Event: Disable length-mapup-os-tasks.

Theorem: length-mapup-cpu (good-os (os) ∧ (taskid < '16)) → (length (mapup-cpu (taskid, os)) = '9)

Event: Disable length-mapup-cpu.

Theorem: finite-number-listp-mapup-cpu (good-os (os) ∧ (taskid < '16)) → finite-number-listp (mapup-cpu (taskid, os), '65536)

Event: Disable finite-number-listp-mapup-cpu.

Theorem: numberp-mapup-base (good-os (os) ∧ (taskid < '16)) → (mapup-base (taskid, os) ∈ N)

Event: Disable numberp-mapup-base.

Theorem: numberp-mapup-limit (good-os (os) ∧ (taskid < '16)) → (mapup-limit (taskid, os) ∈ N)

Event: Disable numberp-mapup-limit.

Theorem: plistp-mapup-regs plistp (mapup-regs (taskid, os))

Event: Disable plistp-mapup-regs.

Theorem: length-mapup-regs length (mapup-regs (taskid, os)) = '8 Event: Disable length-mapup-regs.

Theorem: finite-number-listp-mapup-regs (good-os (os) ∧ (taskid < '16)) → finite-number-listp (mapup-regs (taskid, os), '65536)

Event: Disable finite-number-listp-mapup-regs.

Theorem: finite-numberp-mapup-cc finite-numberp (mapup-cc (taskid, os), '4)

Event: Disable finite-numberp-mapup-cc.

Theorem: finite-numberp-mapup-error finite-numberp (mapup-error (taskid, os), '64)

Event: Disable finite-numberp-mapup-error.

Theorem: finite-numberp-mapup-svcflag finite-numberp (mapup-svcflag (taskid, os), '2)

Event: Disable finite-numberp-mapup-svcflag.

Theorem: finite-numberp-mapup-svcid (good-os (os) ∧ (taskid < '16)) → finite-numberp (mapup-svcid (taskid, os), '128)

Event: Disable finite-numberp-mapup-svcid.

Theorem: leq-plus-base-limit-getnth (finite-segment-tablep (l, max) ∧ (i < length (l))) → if max < (base (getnth (i, l)) + limit (getnth (i, l))) then '*1*false

else '*1*true endif

Theorem: leq-plus-base-limit-getnth-corollary (finite-segment-tablep (l, '65536) ∧ (i < length (l))) → ('65536 ≮ (base (getnth (i, l)) + limit (getnth (i, l))))

Event: Disable leq-plus-base-limit-getnth-corollary.

Theorem: leq-plus-mapup-base-mapup-limit (good-os (os) ∧ (taskid < '16)) → ('65536 ≮ (mapup-base (taskid, os) + mapup-limit (taskid, os)))

Event: Disable leq-plus-mapup-base-mapup-limit.

Theorem: length-tm-memory-mapup-task (good-os (os) ∧ (taskid < '16)) → (length (tm-memory (mapup-task (taskid, os))) = mapup-limit (taskid, os))

Event: Disable length-tm-memory-mapup-task.

Theorem: good-address-space-mapup-task (good-os (os) ∧ finite-numberp (taskid, '16)) → good-address-space (mapup-task (taskid, os),

length (tm-memory (mapup-task (taskid, os))))

Event: Disable good-address-space-mapup-task.

Theorem: good-address-space-list-mapup-tasks (good-os (os) ∧ finite-numberp (taskid, '16)) → good-address-space-list (mapup-tasks (taskid, os))

Event: Disable good-address-space-list-mapup-tasks.

Theorem: good-address-space-list-mapup-os-tasks good-os (os) → good-address-space-list (mapup-os-tasks (os))

Event: Disable good-address-space-list-mapup-os-tasks.

Theorem: length-mapup-os-ibuffers length (mapup-os-ibuffers (os)) = '16

Event: Disable length-mapup-os-ibuffers.

Theorem: good-task-buffer-mapup-queue finite-number-queuep (queue, capacity, '65536) → good-task-buffer (mapup-queue (queue), capacity)

Event: Disable good-task-buffer-mapup-queue.

Theorem: good-task-buffer-list-mapup-queue-list finite-number-queue-listp (l, capacity, '65536) → good-task-buffer-list (mapup-queue-list (l), capacity)

Event: Disable good-task-buffer-list-mapup-queue-list.

Theorem: good-task-buffer-list-mapup-os-ibuffers good-os (os) → good-task-buffer-list (mapup-os-ibuffers (os), '4)

Event: Disable good-task-buffer-list-mapup-os-ibuffers.

Theorem: length-mapup-os-obuffers length (mapup-os-obuffers (os)) = '16

Event: Disable length-mapup-os-obuffers.

Theorem: good-task-buffer-list-mapup-os-obuffers good-os (os) → good-task-buffer-list (mapup-os-obuffers (os), '4)

Event: Disable good-task-buffer-list-mapup-os-obuffers.

Theorem: length-mapup-os-mbuffers length (mapup-os-mbuffers (os)) = '16

Event: Disable length-mapup-os-mbuffers.

Theorem: good-task-buffer-list-nthcdr good-task-buffer-list (l, capacity) → good-task-buffer-list (nthcdr (n, l), capacity)

Event: Disable good-task-buffer-list-nthcdr.

Theorem: good-task-buffer-list-firstn good-task-buffer-list (l, capacity) → good-task-buffer-list (firstn (n, l), capacity)

Event: Disable good-task-buffer-list-firstn.

Theorem: good-task-buffer-list-getseg (good-task-buffer-list (l, capacity) ∧ (if length (l) < n then '*1*false

else '*1*true endif

∧ if (length (l) − n) < k then '*1*false

else '*1*true endif))

→ good-task-buffer-list (getseg (n, k, l), capacity)

Event: Disable good-task-buffer-list-getseg.

Theorem: good-task-buffer-table-table (good-task-buffer-list (l, capacity) ∧ (((length (l) mod n) = '0) ∧ (n ≄ 0))) → good-task-buffer-table (table (n, l), n, capacity)

Event: Disable good-task-buffer-table-table.

Theorem: good-task-buffer-table-mapup-os-mbuffers good-os (os) → good-task-buffer-table (mapup-os-mbuffers (os), '16, '4)

Event: Disable good-task-buffer-table-mapup-os-mbuffers.

Theorem: finite-number-listp-mapup-finite-number-queue finite-number-queuep (queue, capacity, lub) → finite-number-listp (mapup-queue (queue), lub)

Theorem: finite-number-listp-mapup-finite-number-queue-corollary good-os (os) → finite-number-listp (mapup-queue (os-readyq (os)), '16)

Event: Disable finite-number-listp-mapup-finite-number-queue-corollary.

Theorem: ak-ready-set-mapup-os ak-ready-set (mapup-os (os)) = os-ready-set (os)

Event: Disable ak-ready-set-mapup-os.

Theorem: good-ak-mapup-os good-os (os) → good-ak (mapup-os (os))

Event: Disable good-ak-mapup-os.

Theorem: not-qemptyp-mapup-queue-os-readyq (good-os (os) ∧ (¬ tm-waiting (os))) → (¬ qemptyp (mapup-queue (os-readyq (os))))

Event: Disable not-qemptyp-mapup-queue-os-readyq.

Theorem: lessp-qfirst-mapup-queue-os-readyq (good-os (os) ∧ (¬ tm-waiting (os))) → (qfirst (mapup-queue (os-readyq (os))) < '16)

Event: Disable lessp-qfirst-mapup-queue-os-readyq.

Theorem: good-os-tm-set-error (good-os (os) ∧ finite-numberp (error, '64)) → good-os (tm-set-error (error, os))

Event: Disable good-os-tm-set-error.

Theorem: good-os-tm-set-pc (good-os (os) ∧ finite-numberp (pc, '65536)) → good-os (tm-set-pc (pc, os))

Event: Disable good-os-tm-set-pc.

Theorem: good-os-tm-set-sp (good-os (os) ∧ finite-numberp (sp, '65536)) → good-os (tm-set-sp (sp, os))

Event: Disable good-os-tm-set-sp.

Theorem: good-os-tm-set-cc (good-os (os) ∧ finite-numberp (cc, '4)) → good-os (tm-set-cc (cc, os))

Event: Disable good-os-tm-set-cc.

Theorem: good-os-tm-set-svcflag (good-os (os) ∧ finite-numberp (svcflag, '2)) → good-os (tm-set-svcflag (svcflag, os))

Event: Disable good-os-tm-set-svcflag.

Theorem: good-os-tm-set-svcid (good-os (os) ∧ finite-numberp (svcid, '128)) → good-os (tm-set-svcid (svcid, os))

Event: Disable good-os-tm-set-svcid.

Theorem: good-os-tm-store-in-regmem (good-os (os) ∧ finite-numberp (value, '65536)) → good-os (tm-store-in-regmem (value, addr, os))

Event: Disable good-os-tm-store-in-regmem.

Theorem: not-equal-plus-base-limit-0 (good-tm (tm) ∧ ((¬ tm-in-supervisor-mode (tm))

∧ (tm-good-address (addr, tm)

∧ ((real-addr-source (addr) ≄ 0)

∧ (real-addr-source (addr) ≠ '1)))))

→ ((tm-base (tm) + tm-limit (tm)) ≠ '0)

Theorem: equality-of-getseg-backchain-corollary (good-tm (os) ∧ ((¬ tm-in-supervisor-mode (os))

∧ (nested-intervals ('0, '3311, i, j )

∧ (disjoint-everywhere ('0,

                     '3311,

table ('2, os-segment-table (os)))

∧ ((array-qfirst (os-readyq (os)) < length (table ('2,

os-segment-table (os))))

∧ ((tm-base (os)

= base (getnth (array-qfirst (os-readyq (os)), table ('2,

os-segment-table (os)))))

∧ ((tm-limit (os)

= limit (getnth (array-qfirst (os-readyq (os)), table ('2,

os-segment-table (os)))))

∧ (tm-good-address (addr,

os) ∧ ((real-addr-source (addr) ≄ 0) ∧ (real-addr-source (addr) ≠ '1))))))))))

→ (getseg (i, j , putnth (value,

tm-base (os) + real-addr-num (addr), tm-memory (os)))

= getseg (i, j , tm-memory (os)))

Event: Disable equality-of-getseg-backchain-corollary.

Theorem: equality-of-getnth-backchain-corollary (good-tm (os) ∧ ((¬ tm-in-supervisor-mode (os))

∧ (if i < '0 then '*1*false

else '*1*true endif ∧ (((i − '0) < '3311)

∧ (disjoint-everywhere ('0, table ('2,

os-segment-table (os)))

∧ ((array-qfirst (os-readyq (os)) < length (table ('2,

os-segment-table (os))))

∧ ((tm-base (os)

= base (getnth (array-qfirst (os-readyq (os)), table ('2,

os-segment-table (os)))))

∧ ((tm-limit (os)

= limit (getnth (array-qfirst (os-readyq (os)), table ('2,

os-segment-table (os)))))

∧ (tm-good-address (addr,

os) ∧ ((real-addr-source (addr) ≄ 0) ∧ (real-addr-source (addr) ≠ '1)))))))))))

→ (getnth (i,

putnth (value, tm-base (os) + real-addr-num (addr), tm-memory (os)))

= getnth (i, tm-memory (os)))

Event: Disable equality-of-getnth-backchain-corollary.

Theorem: good-os-tm-store-in-memory (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((real-addr-source (addr) ≄ 0)

∧ ((real-addr-source (addr) ≠ '1)

∧ (tm-good-address (addr, os)

∧ finite-numberp (value, '65536))))))

→ good-os (tm-store-in-memory (value, real-addr-num (addr), os))

Event: Disable good-os-tm-store-in-memory.

Theorem: good-os-tm-store (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-good-address (addr, os) ∧ finite-numberp (value, '65536)))) → good-os (tm-store (value, addr, os))

Event: Disable good-os-tm-store.

Theorem: good-os-tm-execute-add (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr1 , os))) → good-os (tm-execute-add (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-add.

Theorem: good-os-tm-execute-branch (good-os (os) ∧ tm-good-address (addr, os)) → good-os (tm-execute-branch (addr, os))

Event: Disable good-os-tm-execute-branch.

Theorem: good-os-tm-execute-branch-on-zero (good-os (os) ∧ tm-good-address (addr, os)) → good-os (tm-execute-branch-on-zero (addr, os))

Event: Disable good-os-tm-execute-branch-on-zero.

Theorem: good-os-tm-execute-branch-not-zero (good-os (os) ∧ tm-good-address (addr, os)) → good-os (tm-execute-branch-not-zero (addr, os))

Event: Disable good-os-tm-execute-branch-not-zero.

Theorem: good-os-tm-execute-call (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr, os))) → good-os (tm-execute-call (addr, os))

Event: Disable good-os-tm-execute-call.

Theorem: good-os-tm-execute-compare (good-os (os) ∧ tm-good-address (addr1 , os)) → good-os (tm-execute-compare (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-compare.

Theorem: good-os-tm-execute-decr (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr, os))) → good-os (tm-execute-decr (addr, os))

Event: Disable good-os-tm-execute-decr.

Theorem: good-os-tm-execute-decr-mod (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr1 , os))) → good-os (tm-execute-decr-mod (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-decr-mod.

Theorem: good-os-tm-execute-incr (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr, os))) → good-os (tm-execute-incr (addr, os))

Event: Disable good-os-tm-execute-incr.

Theorem: good-os-tm-execute-incr-mod (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr1 , os))) → good-os (tm-execute-incr-mod (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-incr-mod.

Theorem: good-os-tm-execute-load-base good-os (os) → good-os (tm-execute-load-base (addr, os))

Event: Disable good-os-tm-execute-load-base.

Theorem: good-os-tm-execute-load-limit good-os (os) → good-os (tm-execute-load-limit (addr, os))

Event: Disable good-os-tm-execute-load-limit.

Theorem: good-os-tm-execute-load-psw good-os (os) → good-os (tm-execute-load-psw (addr, os))

Event: Disable good-os-tm-execute-load-psw.

Theorem: good-os-tm-execute-mod (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr1 , os))) → good-os (tm-execute-mod (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-mod.

Theorem: good-os-tm-execute-move (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-good-address (addr1 , os) ∧ tm-good-address (addr2 , os)))) → good-os (tm-execute-move (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-move.

Theorem: good-os-tm-execute-multiply (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-good-address (addr1 , os))) → good-os (tm-execute-multiply (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-multiply.

Theorem: good-os-tm-execute-return good-os (os) → good-os (tm-execute-return (os))

Event: Disable good-os-tm-execute-return.

Theorem: good-os-tm-execute-post-output-interrupt good-os (os) → good-os (tm-execute-post-output-interrupt (addr, os))

Event: Disable good-os-tm-execute-post-output-interrupt.

Theorem: good-os-tm-execute-run (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute-run (os))

Event: Disable good-os-tm-execute-run.

Theorem: good-os-tm-execute-set-clock good-os (os) → good-os (tm-execute-set-clock (addr, os))

Event: Disable good-os-tm-execute-set-clock.

Theorem: good-os-tm-execute-start-output good-os (os) → good-os (tm-execute-start-output (addr1 , addr2 , os))

Event: Disable good-os-tm-execute-start-output.

Theorem: good-os-tm-execute-svc (good-os (os) ∧ tm-good-address (addr, os)) → good-os (tm-execute-svc (addr, os))

Event: Disable good-os-tm-execute-svc.

Theorem: good-os-tm-execute-svc-return good-os (os) → good-os (tm-execute-svc-return (addr, os))

Event: Disable good-os-tm-execute-svc-return.

Theorem: good-os-tm-execute-test-iport good-os (os) → good-os (tm-execute-test-iport (addr, os))

Event: Disable good-os-tm-execute-test-iport.

Theorem: good-os-tm-execute-test-oport good-os (os) → good-os (tm-execute-test-oport (addr, os))

Event: Disable good-os-tm-execute-test-oport.

Theorem: good-os-tm-execute-wait (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute-wait (os))

Event: Disable good-os-tm-execute-wait.

Theorem: good-os-tm-execute-nullary (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute-nullary (opcode, os))

Event: Disable good-os-tm-execute-nullary.

Theorem: good-os-tm-execute-unary (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute-unary (opcode, addr, os))

Event: Disable good-os-tm-execute-unary.

Theorem: good-os-tm-execute-binary (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute-binary (opcode, addr1 , addr2 , os))

Event: Disable good-os-tm-execute-binary.

Theorem: good-os-tm-execute-instruction (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute-instruction (instruction, os))

Event: Disable good-os-tm-execute-instruction.

Theorem: good-os-tm-execute (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-execute (instruction, os))

Event: Disable good-os-tm-execute.

Theorem: good-os-tm-decrement-clock (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-decrement-clock (os))

Event: Disable good-os-tm-decrement-clock.

Theorem: good-os-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (tm-fetch-execute (os))

Event: Disable good-os-tm-fetch-execute.

Theorem: good-os-tm-set-iports (good-os (os) ∧ (plistp (iports)

∧ ((length (iports) = '16) ∧ good-tm-iport-array (iports)))) → good-os (tm-set-iports (iports, os))

Event: Disable good-os-tm-set-iports.

Theorem: good-os-tm-set-oports (good-os (os) ∧ (plistp (oports)

∧ ((length (oports) = '16) ∧ good-tm-oport-array (oports)))) → good-os (tm-set-oports (oports, os))

Event: Disable good-os-tm-set-oports.

Theorem: good-os-tm-post-interrupt good-os (os) → good-os (tm-post-interrupt (interrupt, os))

Event: Disable good-os-tm-post-interrupt.

Definition: disjoint-segments-induction (i, j , l) = if i ≃ 0 then '0 elseif listp (l) then disjoint-segments-induction (i − 1, j − 1, cdr (l)) else '0 endif

Theorem: mutually-disjoint-segments-are-disjoint-case1 (mutually-disjoint (l) ∧ ((i < length (l)) ∧ ((j < length (l)) ∧ (fix (i) < fix (j ))))) → disjoint (base (getnth (i, l)),

limit (getnth (i, l)), base (getnth (j , l)), limit (getnth (j , l)))

Event: Disable mutually-disjoint-segments-are-disjoint-case1.

Theorem: mutually-disjoint-segments-are-disjoint (mutually-disjoint (l) ∧ ((i < length (l)) ∧ ((j < length (l)) ∧ (fix (i) ≠ fix (j ))))) → disjoint (base (getnth (i, l)),

limit (getnth (i, l)), base (getnth (j , l)), limit (getnth (j , l)))

Event: Disable mutually-disjoint-segments-are-disjoint.

Theorem: numberp-os-current-taskid (good-os (os) ∧ (¬ tm-waiting (os))) → ((os-current-taskid (os) ∈ N) ∧ (os-current-taskid (os) < '16))

Event: Disable numberp-os-current-taskid.

Theorem: tm-fetch-execute-mapup-address-space-separation (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ os-current-taskid (os))))))

→ (mapup-address-space (tm-memory (tm-fetch-execute (os)), regs, cc, error, svcflag, svcid, base (getnth (taskid,

table ('2, os-segment-table (os)))), limit (getnth (taskid,

table ('2, os-segment-table (os)))))

= mapup-address-space (tm-memory (os), regs, cc, error, svcflag, svcid, base (getnth (taskid,

table ('2,

os-segment-table (os)))),

limit (getnth (taskid,

table ('2, os-segment-table (os))))))

Event: Disable tm-fetch-execute-mapup-address-space-separation.

Theorem: getnth-tm-reglength-tm-cpu getnth ('8, tm-cpu (tm)) = tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm))

Event: Disable getnth-tm-reglength-tm-cpu.

Theorem: os-ibuffers-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ibuffers (tm-fetch-execute (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-tm-fetch-execute.

Theorem: os-obuffers-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-obuffers (tm-fetch-execute (os)) = os-obuffers (os))

Event: Disable os-obuffers-tm-fetch-execute.

Theorem: os-mbuffers-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-mbuffers (tm-fetch-execute (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-tm-fetch-execute.

Theorem: os-readyq-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-readyq (tm-fetch-execute (os)) = os-readyq (os))

Event: Disable os-readyq-tm-fetch-execute.

Theorem: os-status-table-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-status-table (tm-fetch-execute (os)) = os-status-table (os))

Event: Disable os-status-table-tm-fetch-execute.

Theorem: os-task-table-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-task-table (tm-fetch-execute (os)) = os-task-table (os))

Event: Disable os-task-table-tm-fetch-execute.

Theorem: os-segment-table-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-segment-table (tm-fetch-execute (os)) = os-segment-table (os))

Event: Disable os-segment-table-tm-fetch-execute.

Theorem: os-current-taskid-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (os-current-taskid (tm-fetch-execute (os)) = os-current-taskid (os))

Event: Disable os-current-taskid-tm-fetch-execute.

Theorem: tm-waiting-tm-fetch-execute good-os (os) → (tm-waiting (tm-fetch-execute (os)) = tm-waiting (os))

Event: Disable tm-waiting-tm-fetch-execute.

Event: Let us define the theory good-os-properties-crock to consist of the following events: finite-numberp-os-taskid, tm-waiting-iff-array-qemptyp-os-readyq, permutation-os-readyq-qarray-os-ready-set, finite-number-queue-tablep-os-mbuffers, finite-number-queue-listp-os-obuffers, finite-number-queue-listp-os-ibuffers, finitesegment-tablep-os-segment-table, disjoint-everywhere-os-segment-table, mutuallydisjoint-os-segment-table, finite-number-queuep-os-readyq, good-status-list-os-status-table, good-cpu-list-os-task-table, os-not-in-supervisor-mode, os-time-slice, os-output-new-pc, os-input-new-pc, os-svc-new-pc, os-error-new-pc, os-clock-new-pc, os-code-os, tm-slimit-os, good-tm-os.

Theorem: times-commutativity-associativity-crock (a ∗ (c ∗ b)) = ((a ∗ b) ∗ c)

Event: Disable times-commutativity-associativity-crock.

Theorem: tm-unpack-cc-tm-pack-psw finite-numberp (cc, '4) → (tm-unpack-cc (tm-pack-psw (cc, error, svcflag, svcid)) = cc)

Event: Disable tm-unpack-cc-tm-pack-psw.

Theorem: remainder-plus-plus-times ((a + (b + (j ∗ i))) mod j ) = ((a + b) mod j )

Event: Disable remainder-plus-plus-times.

Theorem: tm-unpack-error-tm-pack-psw (finite-numberp (cc, '4) ∧ finite-numberp (error, '64)) → (tm-unpack-error (tm-pack-psw (cc, error, svcflag, svcid)) = error)

Event: Disable tm-unpack-error-tm-pack-psw.

Theorem: remainder-plus-plus-plus-times ((a + (b + (c + (i ∗ j )))) mod j ) = ((a + (b + c)) mod j )

Event: Disable remainder-plus-plus-plus-times.

Theorem: quotient-plus-plus-times ((c + d) < b) → (((c + (d + (b ∗ a))) ÷ b) = fix (a))

Event: Disable quotient-plus-plus-times.

Theorem: tm-unpack-svcflag-tm-pack-psw (finite-numberp (cc, '4) ∧ (finite-numberp (error, '64) ∧ finite-numberp (svcflag, '2))) → (tm-unpack-svcflag (tm-pack-psw (cc, error, svcflag, svcid)) = svcflag)

Event: Disable tm-unpack-svcflag-tm-pack-psw.

Theorem: quotient-plus-plus-plus-times ((c + (d + e)) < b) → (((c + (d + (e + (b ∗ a)))) ÷ b) = fix (a))

Event: Disable quotient-plus-plus-plus-times.

Theorem: tm-unpack-svcid-tm-pack-psw (finite-numberp (cc, '4) ∧ (finite-numberp (error, '64)

∧ (finite-numberp (svcflag, '2) ∧ finite-numberp (svcid, '128)))) → (tm-unpack-svcid (tm-pack-psw (cc, error, svcflag, svcid)) = svcid)

Event: Disable tm-unpack-svcid-tm-pack-psw.

Theorem: mapup-current-task-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-task (os-current-taskid (os), tm-fetch-execute (os))

= tm-fetch-execute (mapup-task (os-current-taskid (os), os)))

Event: Disable mapup-current-task-tm-fetch-execute.

Theorem: mapup-task-separation (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ os-current-taskid (os))))))

→ (mapup-task (taskid, tm-fetch-execute (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-separation.

Theorem: mapup-task-tm-fetch-execute-casesplit (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, tm-fetch-execute (os))

= if taskid = os-current-taskid (os)

then tm-fetch-execute (mapup-task (os-current-taskid (os), os)) else mapup-task (taskid, os) endif)

Event: Disable mapup-task-tm-fetch-execute-casesplit.

Theorem: mapup-tasks-tm-fetch-execute-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N) ∧ (os-current-taskid (os) < taskid)))) → (mapup-tasks (taskid, tm-fetch-execute (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-tm-fetch-execute-case1.

Theorem: getnth-mapup-tasks ((i < '16) ∧ (if i < j then '*1*false

else '*1*true endif ∧ ((j ∈ N) ∧ (i ∈ N))))

→ (getnth (i − j , mapup-tasks (j , os)) = mapup-task (i, os))

Theorem: getnth-mapup-tasks-corollary2 ((i < '16) ∧ (i ∈ N)) → (getnth ('0, mapup-tasks (i, os)) = mapup-task (i, os))

Event: Disable getnth-mapup-tasks-corollary2.

Theorem: mapup-tasks-tm-fetch-execute-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ if os-current-taskid (os) < taskid then '*1*false

else '*1*true endif)))

→ (mapup-tasks (taskid, tm-fetch-execute (os))

= putnth (tm-fetch-execute (getnth (os-current-taskid (os)

− taskid,

mapup-tasks (taskid, os))),

os-current-taskid (os) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-tm-fetch-execute-case2.

Theorem: difference-zero-arg2 (n − '0) = fix (n)

Event: Disable difference-zero-arg2.

Theorem: mapup-os-tasks-tm-fetch-execute (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (tm-fetch-execute (os))

= putnth (tm-fetch-execute (getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-tm-fetch-execute.

Theorem: correctness-of-tm-fetch-execute (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-clock-interruptp (os)))) → (mapup-os (tm-fetch-execute (os)) = ak-private-step (mapup-os (os)))

Event: Disable correctness-of-tm-fetch-execute.

Theorem: contract-array-enq (maxlength = getnth ('3, queue)) → (putnth (incr-mod (getnth ('1, queue), maxlength),

            '1,

putnth (1 + getnth ('2, queue),

                   '2,

putnth (item, '4 + getnth ('1, queue), queue)))

= array-enq (item, queue))

Event: Disable contract-array-enq.

Theorem: contract-array-enq-instance (array-queuep (queue) ∧ array-qemptyp (queue)) → ((maxlength = getnth ('3, queue))

→ (putnth (incr-mod (getnth ('1, queue), maxlength),

                 '1,

putnth ('1,

                        '2,

putnth (item, '4 + getnth ('1, queue), queue)))

= array-enq (item, queue)))

Event: Disable contract-array-enq-instance.

Theorem: contract-array-deq (maxlength = getnth ('3, queue)) → (putnth (incr-mod (getnth ('0, queue), maxlength),

            '0,

putnth (getnth ('2, queue) − 1, '2, queue)) = array-deq (queue))

Event: Disable contract-array-deq.

Theorem: contract-array-qfirst getnth ('4 + getnth ('0, queue), queue) = array-qfirst (queue)

Event: Disable contract-array-qfirst.

Theorem: contract-array-qreplace (array-queuep (queue) ∧ ((¬ array-qemptyp (queue)) ∧ (maxlength = getnth ('3, queue)))) → (putnth (item, '4 + decr-mod (getnth ('1, queue), maxlength), queue)

= array-qreplace (item, queue))

Event: Disable contract-array-qreplace.

Event: Let us define the theory contract-queues to consist of the following events: contract-array-qfirst, contract-array-enq-instance, contract-array-qreplace, contract-array-enq, contract-array-deq.

Definition: tick (n) = fixlength (n, 'nil, 'tick)

Theorem: tick-plus tick (a + b) = append (tick (a), tick (b))

Theorem: getnth-os-code good-os (os) → (getnth (n, os-code (os))

= getnth (n,

'(2187 13 2 2187 14 3 75 3 191 14 3280 77
2 9 65 2 15 4299 2 0 12747 2 0 4811 2 13
5067 2 14 3275 2 4 3531 2 5 3787 2 6 4043
2 7 65 2 8 20683 2 0 4171 2 13 4171 3 14
0 2123 3 2 77 2 9 65 2 15 77 3 2 65 3 159
218 3 478 3 2123 3 2 65 3 8 6283 0 2
14731 0 2 6795 0 3 63563 7 2 55371 6 2
47179 5 2 38987 4 2 30795 3 2 22603 2 2
0 14 2547 75 3 191 14 3280 14 3274 14
3240 2 3206 14 2547 75 3 191 14 3280 14
3274 77 2 2 65 2 211 203 2 1 459 2 0 2
3206 14 2547 137 8 4 131 8 0 10 2712 131
8 1 10 2813 131 8 2 10 2922 2 2981 2123
6 2 73 6 16 2123 7 3 75 3 191 14 3280
2187 12 2 2123 4 6 77 4 8 2123 3 2 77 3
128 2113 3 4 65 3 499 14 3297 10 2791
2123 2 7 14 3240 2123 3 6 77 3 2 65 3 211
195 3 3 6 3222 4547 3 12 6 3222 203 3 0
459 3 0 2123 2 6 75 3 191 14 3240 2 3222
75 3 191 14 3274 4171 3 12 77 3 2 65 3

211 203 3 2 2507 3 6 2 3206 2123 6 2 73
6 16 75 3 191 14 3280 2187 12 2 2123 4 2
77 4 8 2123 3 6 77 3 128 2113 3 4 65 3
499 14 3293 10 2900 14 3280 14 3274 4171
3 12 77 3 9 65 3 15 3019 3 2 2123 3 6 77
3 2 65 3 211 195 3 2 6 3222 4547 3 12 6
3222 203 3 0 459 3 0 2123 2 6 75 3 191
14 3240 2 3222 75 3 191 14 3274 4171 3
12 77 3 2 65 3 211 203 3 3 2507 3 6 2
3206 2123 7 3 75 3 191 14 3280 2187 12 2
2123 3 2 77 3 8 65 3 371 14 3297 10 2959
2123 2 7 14 3240 182 12 6 3222 166 12 2
3222 75 3 191 14 3274 4171 3 12 77 3 2
65 3 211 203 3 4 459 3 0 2 3206 75 3 191
14 3280 2187 12 2 2123 3 2 77 3 8 65 3
243 14 3293 10 3020 14 3280 14 3274 4171
3 12 77 3 9 65 3 15 3019 3 2 2 3222 75 3
191 14 3274 4171 3 12 77 3 2 65 3 211 203
3 5 459 3 0 2 3206 139 10 3206 2187 14 3
75 3 191 14 3293 10 3063 139 10 3231 4171
3 14 14 2547 4171 5 8 77 5 2 65 5 211 195
5 5 6 3091 4171 2 8 75 3 191 14 3240 203
5 0 459 5 0 4171 3 8 77 3 8 65 3 243 14
3297 6 3114 4171 2 9 65 2 256 14 3258 130
10 178 8 6 3128 4171 2 9 65 2 256 14 3240
130 10 4171 2 9 14 3240 130 10 139 10
3206 2187 14 3 75 3 191 14 3293 10 3156
139 10 3231 4171 3 14 14 2547 4171 5 9
77 5 2 65 5 211 195 5 4 6 3184 4171 2 9
75 3 191 14 3240 203 5 0 459 5 0 4171 3
9 77 3 8 65 3 371 14 3293 138 10 14 3280
2191 9 2 14 3274 130 10 75 3 191 14 3293
10 3221 14 3280 14 2601 186 11 162 0 4
75 3 191 14 3280 14 2601 174 0 75 3 191
14 3280 14 2601 162 0 2123 4 3 65 4 4
14401 4 3 2251 4 2 726 3 31175 3 3 0
14411 4 3 30789 4 3 2113 4 3 65 4 4 2251
4 2 0 722 3 30919 3 3 0 2123 2 3 65 2 4
6209 2 3 6219 2 2 0 707 3 0 0 31427 3 3
0)))

Event: Disable getnth-os-code.

Event: Let us define the theory tracing-lemmas to consist of the following events: getnth-os-code, open-up-tm-processor, tick, tm-processor-with-null-oracle.

Event: Let us define the theory os-segment-lengths to consist of the following events: length-os-task-table, plistp-os-task-table, length-os-segment-table, plistp-os-segment-table, length-os-readyq, plistp-os-readyq, length-os-status-table, plistp-os-status-table, length-os-ibuffers, plistp-os-ibuffers, length-os-obuffers, plistpos-obuffers, length-os-mbuffers, plistp-os-mbuffers, length-os-code, plistp-os-code.

Event: Let us define the theory trace-arithmetic to consist of the following events: canonicalize-plus-terms1, canonicalize-plus-terms2, canonicalize-plus-terms3, commutativity-of-plus, commutativity-of-times, difference-x-x, differenceplus2, difference-plus-cancellation2-instance, plus-0-arg1, times-1, yet-another-difference-plus-crock, lessp-remainder2.

Event: Let us define the theory finite-number-queue-corollaries1 to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary, array-qfirst-finite-number-queue-corollary, finite-number-queuep-array-deq-finite-number-queue-corollary, finite-number-queuep-array-enq-finite-number-queue-corollary, finite-number-queue-qmaxlength-value-corollary, finite-number-queue-qcurrlength-size-corollary, finite-number-queue-qtail-size-corollary, finite-number-queue-qhead-size-corollary, array-queuep-finite-number-queue-corollary.

Event: Let us define the theory good-os-properties1 to consist of the following events: finite-numberp-os-taskid, permutation-os-readyq-qarray-os-ready-set, finite-number-queue-listp-os-mbuffers, finite-number-queue-tablep-os-mbuffers, finite-number-queue-listp-os-obuffers, finite-number-queue-listp-os-ibuffers, finitesegment-tablep-os-segment-table, disjoint-everywhere-os-segment-table, mutuallydisjoint-os-segment-table, finite-number-queuep-os-readyq, good-status-list-os-status-table, good-cpu-list-os-task-table, tm-limit-os, tm-base-os, os-not-in-supervisor-mode, os-time-slice, os-output-new-pc, os-input-new-pc, os-svc-new-pc, os-error-new-pc, os-clock-new-pc, tm-slimit-os, good-tm-os.

Event: Let us define the theory memory-reference to consist of the following events: getnth-putnth-coincidence, getnth-putnth-non-interference, getnthafter-putseg, getnth-before-putseg, getnth-putseg-coincidence, putnth-coincidence, putnth-non-interference-corollary1, putnth-non-interference-corollary2, putnthafter-putseg, putnth-putseg-coincidence, length-getseg, length-putseg, lengthputnth.

Event: Let us define the theory trace-array-queue-facts to consist of the following events: array-qcurrlength-in-an-empty-queue, array-qcurrlength-in-a-non-empty-queue, array-qcurrlength-in-a-non-full-queue, array-qcurrlength-in-a-full-queue, not-array-qfullp-array-deq, not-array-qemptyp-array-enq, array-queuep-array-deq, plistp-array-deq, length-array-deq, array-queuep-array-enq, plistparray-enq, length-array-enq, length-array-qarray, plistp-array-qarray, lessp-qcurrlength-add1-qmaxlength, lessp-qtail-qmaxlength, lessp-qhead-qmaxlength, qmaxlengthgreater-than-zero, qmaxlength-non-zero, numberp-qmaxlength, numberp-qcurrlength, numberp-qtail, numberp-qhead.

Definition: os-readyq-qarray-address = '195

Theorem: os-readyq-address-facts finite-number-queuep (queue, '16, '16) → (((('195 + getnth ('0, queue)) < '65536) = '*1*true)

∧ ((('195 + getnth ('1, queue)) < '65536) = '*1*true))

Event: Disable os-readyq-address-facts.

Theorem: tm-pack-psw-tm-unpack-fields1 tm-pack-psw (tm-unpack-cc (n),

tm-unpack-error (n), tm-unpack-svcflag (n), tm-unpack-svcid (n))

= ((n mod '256)

+ (('256 ∗ ((n mod '512) ÷ '256))

+ ('512 ∗ (n ÷ '512))))

Event: Disable tm-pack-psw-tm-unpack-fields1.

Theorem: tm-pack-psw-tm-unpack-fields2 ((n mod '256) + (('256 ∗ ((n mod '512) ÷ '256))

+ ('512 ∗ (n ÷ '512)))) = ((n mod '512) + ('512 ∗ (n ÷ '512)))

Event: Disable tm-pack-psw-tm-unpack-fields2.

Theorem: tm-pack-psw-tm-unpack-fields (n ∈ N) → (tm-pack-psw (tm-unpack-cc (n),

tm-unpack-error (n), tm-unpack-svcflag (n), tm-unpack-svcid (n))

= n)

Event: Disable tm-pack-psw-tm-unpack-fields.

Theorem: list-of-getnths9 (plistp (l) ∧ (length (l) = '9)) → (cons (getnth ('0, l),

cons (getnth ('1, l),

cons (getnth ('2, l),

cons (getnth ('3, l),

cons (getnth ('4, l),

cons (getnth ('5, l),

cons (getnth ('6, l),

cons (getnth ('7, l),

cons (getnth ('8, l), 'nil)))))))))

= l)

Event: Disable list-of-getnths9.

(PROVE-LEMMA CONTRACT-CPU
 (REWRITE)
 (IMPLIES
  (GOOD-CPU CPU)
  (EQUAL
   (CONS
    (GETNTH '0 CPU)
    (CONS
     (GETNTH '1 CPU)
     (CONS
      (GETNTH '2 CPU)
      (CONS
       (GETNTH '3 CPU)
       (CONS
        (GETNTH '4 CPU)
        (CONS
            (GETNTH '5 CPU)
            (CONS (GETNTH '6 CPU)
                  (CONS (GETNTH '7 CPU)
                        (CONS (TM-PACK-PSW (TM-UNPACK-CC (GETNTH '8 CPU))
                                           (TM-UNPACK-ERROR (GETNTH '8 CPU))
                                           (TM-UNPACK-SVCFLAG (GETNTH '8 CPU))
                                           (TM-UNPACK-SVCID (GETNTH '8 CPU)))
                              'NIL)))))))))

   CPU))
 ((ENABLE TM-PACK-PSW-TM-UNPACK-FIELDS GOOD-CPU LIST-OF-GETNTHS9
          FINITE-NUMBERP-GETNTH OPEN-UP-GETNTH OPEN-UP-GETNTH-ON-ZERO)
  (USE (A-FINITE-NUMBER-IS-A-NUMBER (N (GETNTH '8 CPU))
                                    (LUB '65536)))
  (ENABLE-THEORY GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable contract-cpu.

Theorem: list-of-putnths8 (plistp (l) ∧ (length (l) = '8)) → (putnth (a,

            '0,

putnth (b,

                   '1,

putnth (c,

                          '2,

putnth (d,

                                '3,

putnth (w,

                                       '4,

putnth (x,

                                              '5,

putnth (y,

                                                    '6,

putnth (z, '7, l))))))))

= cons (a,

cons (b,

cons (c, cons (d, cons (w, cons (x, cons (y, cons (z, 'nil)))))))))

Event: Disable list-of-putnths8.

Theorem: contract-list-of-getnths8 ((n ∈ N) ∧ if length (l) < ('8 + n) then '*1*false

else '*1*true endif) → (cons (getnth (n, l),

cons (getnth ('1 + n, l),

cons (getnth ('2 + n, l),

cons (getnth ('3 + n, l), cons (getnth ('4 + n, l), cons (getnth ('5 + n, l),

cons (getnth ('6 + n, l),

cons (getnth ('7 + n, l), 'nil))))))))

= getseg (n, '8, l))

Event: Disable contract-list-of-getnths8.

Theorem: contract-sequence-of-putnths8 ((n ∈ N) ∧ if length (l) < ('9 + n) then '*1*false

else '*1*true endif) → (putnth (v0 ,

n,

putnth (v1 , '1 + n, putnth (v2 ,

'2 + n, putnth (v3 ,

'3 + n, putnth (v4 ,

'4 + n, putnth (v5 ,

'5 + n, putnth (v6 ,

'6 + n, putnth (v7 ,

'7 + n, putnth (v8 ,

                                                                  '8

+ n, l)))))))))

= putseg (cons (v0 ,

cons (v1 ,

cons (v2 ,

cons (v3 ,

cons (v4 ,

cons (v5 ,

cons (v6 ,

cons (v7 ,

cons (v8 , 'nil))))))))),

n, l))

Event: Disable contract-sequence-of-putnths8.

(PROVE-LEMMA
CONTRACT-PUTNTHS-INTO-TASK-TABLE
(REWRITE)
(IMPLIES
 (AND (GOOD-TM OS) (LESSP ID '16))
 (EQUAL
  (PUTNTH
   (GETNTH '0 (TM-REGS OS))
   (TIMES '9 ID)
   (PUTNTH
    (GETNTH '1 (TM-REGS OS))
    (PLUS '1 (TIMES '9 ID))
    (PUTNTH
     (GETNTH '2 (TM-REGS OS))
     (PLUS '2 (TIMES '9 ID))
     (PUTNTH
      (GETNTH '3 (TM-REGS OS))
      (PLUS '3 (TIMES '9 ID))
      (PUTNTH
       (GETNTH '4 (TM-REGS OS))
       (PLUS '4 (TIMES '9 ID))
       (PUTNTH
        (GETNTH '5 (TM-REGS OS))
        (PLUS '5 (TIMES '9 ID))
        (PUTNTH
              (GETNTH '6 (TM-REGS OS))
              (PLUS '6 (TIMES '9 ID))
              (PUTNTH (GETNTH '7 (TM-REGS OS))
                      (PLUS '7 (TIMES '9 ID))
                      (PUTNTH (PLUS (TM-CC OS)
                                    (PLUS (TIMES '4 (TM-ERROR OS))
                                          (PLUS (TIMES '256 (TM-SVCFLAG OS))
                                                (TIMES '512 (TM-SVCID OS)))))
                              (PLUS '8 (TIMES '9 ID))
                              (OS-TASK-TABLE OS))))))))))
  (PUTSEG (TM-CPU OS)
          (TIMES '9 ID)
          (OS-TASK-TABLE OS))))
((ENABLE TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4 TM-R5 TM-R6 TM-R7 TM-PACK-PSW
         COMMUTATIVITY-OF-PLUS COMMUTATIVITY-OF-TIMES
         CONTRACT-SEQUENCE-OF-PUTNTHS8 LENGTH-OS-TASK-TABLE)
 (ENABLE-THEORY GOOD-TM-PROPERTIES GROUND-ZERO)

(DISABLE PLUS TIMES)
(DISABLE-THEORY T)))

Event: Disable contract-putnths-into-task-table.

(PROVE-LEMMA
CONTRACT-PUTNTHS-INTO-REGMEM
(REWRITE)
(IMPLIES
(AND (GOOD-TM OS)
     (AND (EQUAL (LENGTH TASK-TABLE) '144)
          (AND (NUMBERP TASKID)
               (LESSP TASKID '16))))
(EQUAL
 (PUTNTH
  (GETNTH (TIMES '9 TASKID) TASK-TABLE)
  '0
  (PUTNTH
   (GETNTH (PLUS '1 (TIMES '9 TASKID))
           TASK-TABLE)
   '1
   (PUTNTH
    (GETNTH (PLUS '2 (TIMES '9 TASKID))
            TASK-TABLE)
    '2
    (PUTNTH
        (GETNTH (PLUS '3 (TIMES '9 TASKID))
                TASK-TABLE)
        '3
        (PUTNTH (GETNTH (PLUS '4 (TIMES '9 TASKID))
                        TASK-TABLE)
                '4
                (PUTNTH (GETNTH (PLUS '5 (TIMES '9 TASKID))
                                TASK-TABLE)
                        '5
                        (PUTNTH (GETNTH (PLUS '6 (TIMES '9 TASKID))
                                        TASK-TABLE)
                                '6
                                (PUTNTH (GETNTH (PLUS '7 (TIMES '9 TASKID))
                                                TASK-TABLE)
                                        '7
                                        (TM-REGS OS)))))))))

 (GETSEG '0
         '8
         (GETNTH TASKID
                 (TABLE '9 TASK-TABLE)))))
((ENABLE-THEORY GOOD-TM-PROPERTIES GROUND-ZERO)
(ENABLE LIST-OF-PUTNTHS8 LENGTH-TABLE CONTRACT-LIST-OF-GETNTHS8 GETNTH-TABLE
        COMMUTATIVITY-OF-TIMES GETSEG-GETSEG PLUS-0)
(DISABLE PLUS TIMES)
(DISABLE-THEORY T)))

Event: Disable contract-putnths-into-regmem.

(PROVE-LEMMA
OS-TASK-TABLE-ADDRESS-FACTS
(REWRITE)
(IMPLIES
(LESSP ID '16)
(AND
  (EQUAL (LESSP (PLUS '15 (TIMES '9 ID))
                '65536)
         '*1*TRUE)
  (AND (EQUAL (LESSP (PLUS '16 (TIMES '9 ID))
                     '65536)
              '*1*TRUE)
       (AND (EQUAL (LESSP (PLUS '17 (TIMES '9 ID))
                          '65536)
                   '*1*TRUE)
            (AND (EQUAL (LESSP (PLUS '18 (TIMES '9 ID))
                               '65536)
                        '*1*TRUE)
                 (AND (EQUAL (LESSP (PLUS '19 (TIMES '9 ID))
                                    '65536)
                             '*1*TRUE)
                      (AND (EQUAL (LESSP (PLUS '20 (TIMES '9 ID))
                                         '65536)
                                  '*1*TRUE)
                           (AND (EQUAL (LESSP (PLUS '21 (TIMES '9 ID))
                                              '65536)
                                       '*1*TRUE)
                                (AND (EQUAL (LESSP (PLUS '22 (TIMES '9 ID))
                                                   '65536)
                                            '*1*TRUE)

                                       (EQUAL (LESSP (PLUS '23 (TIMES '9 ID))
                                                     '65536)
                                              '*1*TRUE))))))))))
 ((ENABLE-THEORY GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable os-task-table-address-facts.

Definition: os-new-task-table (os) = putseg (tm-cpu (os),

'9 ∗ array-qfirst (os-readyq (os)), os-task-table (os))

Definition: os-new-regs (taskid, tm) = getseg ('0, '8, getnth (taskid, table ('9, os-new-task-table (tm))))

Definition: os-new-flags (taskid, tm) = getnth ('8, getnth (taskid, table ('9, os-new-task-table (tm))))

Definition: os-new-cc (taskid, tm) = tm-unpack-cc (os-new-flags (taskid, tm))

Definition: os-new-error (taskid, tm) = tm-unpack-error (os-new-flags (taskid, tm))

Definition: os-new-svcflag (taskid, tm) = tm-unpack-svcflag (os-new-flags (taskid, tm))

Definition: os-new-svcid (taskid, tm) = tm-unpack-svcid (os-new-flags (taskid, tm))

Definition: os-new-base (taskid, os) = base (getnth (taskid, table ('2, os-segment-table (os))))

Definition: os-new-limit (taskid, os) = limit (getnth (taskid, table ('2, os-segment-table (os))))

Event: Let us define the theory os-new-cpu to consist of the following events: os-new-base, os-new-cc, os-new-error, os-new-flags, os-new-limit, os-new-regs, os-new-svcflag, os-new-svcid.

Theorem: good-cpu-list-os-new-task-table (good-os (os) ∧ (¬ tm-waiting (os))) → good-cpu-list (table ('9, os-new-task-table (os)))

Event: Disable good-cpu-list-os-new-task-table.

Theorem: os-segment-table-address-facts (id < '16)

 → (((('159 + ('2 ∗ id)) < '65536) = '*1*true)
     ∧ (((('160 + ('2 ∗ id)) < '65536) = '*1*true)

          ∧ (((('2 ∗ id) < '32) = '*1*true)

∧ ((('1 + ('2 ∗ id)) < '32)

                  = '*1*true))))

Event: Disable os-segment-table-address-facts.

Theorem: contract-os-new-base-expression (('2 ∗ taskid) < '32) → (getnth ('2 ∗ taskid, os-segment-table (os))

= base (getnth (taskid, table ('2, os-segment-table (os)))))

Event: Disable contract-os-new-base-expression.

Theorem: contract-os-new-limit-expression (('1 + ('2 ∗ taskid)) < '32) → (getnth ('1 + ('2 ∗ taskid), os-segment-table (os))

= limit (getnth (taskid, table ('2, os-segment-table (os)))))

Event: Disable contract-os-new-limit-expression.

Event: Let us define the theory access-os-segment-table to consist of the following events: os-segment-table-address-facts, contract-os-new-base-expression, contract-os-new-limit-expression.

Theorem: contract-sequence-of-putnths2 ((n ∈ N) ∧ if length (l) < ('2 + n) then '*1*false

else '*1*true endif) → (putnth (a, n, putnth (b, '1 + n, l))

= putseg (cons (a, cons (b, 'nil)), n, l))

Event: Disable contract-sequence-of-putnths2.

Theorem: contract-putnths-into-status-table (i < '16) → (putnth (a, '2 ∗ i, putnth (b, '1 + ('2 ∗ i), os-status-table (os)))

= putseg (cons (a, cons (b, 'nil)), '2 ∗ i, os-status-table (os)))

Event: Disable contract-putnths-into-status-table.

Theorem: os-status-table-address-facts (id < '16)

 → (((('2 ∗ id) < '65536) = '*1*true)
     ∧ (((('211 + ('2 ∗ id)) < '65536) = '*1*true)

∧ (((('212 + ('2 ∗ id)) < '65536)

              = '*1*true)
              ∧ (((('2 ∗ id) < '32) = '*1*true)

∧ ((((1 + ('2 ∗ id)) < '32)

                       = '*1*true)

∧ (((('1 + ('2 ∗ id))

                            < '32)
                           = '*1*true)
                          ∧ (('32

                               < ('2

                                   + ('2

∗ id)))

                              = '*1*false)))))))

Event: Disable os-status-table-address-facts.

Theorem: access-os-status-table-crock (good-tm (os) ∧ (id < '16)) → ((getnth ('2 ∗ id, os-status-table (os)) ∈ N)

∧ ((getnth ('2 ∗ id, os-status-table (os)) < '65536)

∧ ((getnth ('1 + ('2 ∗ id), os-status-table (os)) ∈ N)

∧ (getnth ('1 + ('2 ∗ id),

os-status-table (os))

                  < '65536))))

Event: Disable access-os-status-table-crock.

Theorem: finite-numberp-getnth-os-status-table (good-tm (os) ∧ (i < '32)) → finite-numberp (getnth (i, os-status-table (os)), '65536)

Event: Let us define the theory access-os-status-table to consist of the following events: contract-putnths-into-status-table, os-status-table-address-facts, accessos-status-table-crock.

Definition: os-update-status (id, status, flag, os) = putseg (cons (status, cons (flag, 'nil)), '2 ∗ id, os-status-table (os))

Theorem: re-associate-times ((1 + a) ∗ ((1 + b) ∗ c)) = (((1 + a) ∗ (1 + b)) ∗ c)

Event: Disable re-associate-times.

Theorem: limited-associativity-of-plus (((1 + a) + (b + c)) + d) = ((1 + a) + ((b + c) + d))

Event: Disable limited-associativity-of-plus.

Event: Let us define the theory finite-number-queue-corollaries-for-mbuffers to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary-for-mbuffers, array-qfirst-finite-number-queue-corollary-for-mbuffers, finitenumber-queuep-array-deq-finite-number-queue-corollary-for-mbuffers, finite-number-queuep-array-enq-finite-number-queue-corollary-for-mbuffers, finite-number-queue-qmaxlength-value-corollary-for-mbuffers, finite-number-queue-qcurrlength-size-corollary-for-mbuffers, finite-number-queue-qtail-size-corollary-for-mbuffers, finitenumber-queue-qhead-size-corollary-for-mbuffers, array-queuep-finite-number-queue-corollary-for-mbuffers, plistp-finite-number-queue-corollary-for-mbuffers, lengthfinite-number-queue-corollary-for-mbuffers.

Event: Let us define the theory finite-number-queue-corollaries-for-mbuffers1 to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary-for-mbuffers, array-qfirst-finite-number-queue-corollary-for-mbuffers, finitenumber-queuep-array-deq-finite-number-queue-corollary-for-mbuffers, finite-number-queuep-array-enq-finite-number-queue-corollary-for-mbuffers, finite-number-queue-qcurrlength-size-corollary-for-mbuffers, finite-number-queue-qtail-size-corollary-for-mbuffers, finite-number-queue-qhead-size-corollary-for-mbuffers, array-queuep-finite-number-queue-corollary-for-mbuffers, plistp-finite-number-queue-corollary-for-mbuffers, length-finite-number-queue-corollary-for-mbuffers.

Definition: os-mbuffer-source-multiplier = '128

Definition: os-mbuffer-dest-multiplier = '8

Definition: os-mbuffers-address-plus-qtail-field = '500 Definition: os-mbuffers-address-plus-qcurrlength-field = '501

Definition: os-mbuffers-address-plus-qmaxlength-field = '502

Definition: os-mbuffers-address-plus-qarray-field = '503

Definition: os-current-mbuffer (sid, did, os) = getnth (('16 ∗ sid) + did, table ('8, os-mbuffers (os)))

Theorem: finite-number-queuep-current-mbuffer (good-os (os) ∧ ((sid < '16) ∧ (did < '16))) → finite-number-queuep (getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os))),

                       '4,
                       '65536)

Event: Disable finite-number-queuep-current-mbuffer.

Theorem: finite-number-queuep-current-mbuffer-for-receive (good-os (os) ∧ ((sid < '16) ∧ (did < '16))) → finite-number-queuep (getnth (did + ('16 ∗ sid),

table ('8, os-mbuffers (os))),

                       '4,
                       '65536)

Event: Disable finite-number-queuep-current-mbuffer-for-receive.

Theorem: re-associate-times1 ('8 ∗ (b + ('16 ∗ a))) = (('8 ∗ b) + ('128 ∗ a))

Event: Disable re-associate-times1.

Theorem: rewrite-os-mbuffer-address (('8 ∗ (getnth ('2, tm-regs (os)) mod '16)) + ('128 ∗ array-qfirst (os-readyq (os))))

 = ('8

∗ ((getnth ('2, tm-regs (os)) mod '16) + ('16 ∗ array-qfirst (os-readyq (os)))))

Event: Disable rewrite-os-mbuffer-address.

Theorem: rewrite-os-mbuffer-address1 (('8 ∗ array-qfirst (os-readyq (os))) + ('128 ∗ (getnth ('2, tm-regs (os)) mod '16)))

= ('8

∗ (array-qfirst (os-readyq (os)) + ('16 ∗ (getnth ('2, tm-regs (os)) mod '16))))

Event: Disable rewrite-os-mbuffer-address1.

Theorem: os-mbuffers-address-facts1 (i < '16)

→ (((('8 ∗ i) < '65536) = '*1*true)
     ∧ (((('128 ∗ i) < '2048) = '*1*true)
         ∧ (((('128 ∗ i) < '65536) = '*1*true)
             ∧ ((('16 ∗ i) < '256) = '*1*true))))

Event: Disable os-mbuffers-address-facts1.

(PROVE-LEMMA
OS-MBUFFERS-ADDRESS-FACTS2
(REWRITE)
(IMPLIES
 (AND (LESSP I '16) (LESSP J '16))
 (AND
  (EQUAL (LESSP (PLUS (TIMES '8 J) (TIMES '128 I))
                '65536)
         '*1*TRUE)
  (AND
   (EQUAL (LESSP (PLUS '500
                       (PLUS (TIMES '8 J) (TIMES '128 I)))
                 '65536)
          '*1*TRUE)
   (AND
    (EQUAL (LESSP (PLUS '499
                        (PLUS (TIMES '8 J) (TIMES '128 I)))
                  '65536)
           '*1*TRUE)
    (AND
     (EQUAL (LESSP (PLUS '501
                         (PLUS (TIMES '8 J) (TIMES '128 I)))
                   '65536)
            '*1*TRUE)

(AND
(EQUAL (LESSP (PLUS '502
                    (PLUS (TIMES '8 J) (TIMES '128 I)))
              '65536)
       '*1*TRUE)
(AND
 (EQUAL (LESSP (PLUS '503
                     (PLUS (TIMES '8 J) (TIMES '128 I)))
               '65536)
        '*1*TRUE)
 (AND
     (EQUAL (LESSP (PLUS '1
                         (PLUS (TIMES '8 J) (TIMES '128 I)))
                   '2048)
            '*1*TRUE)
     (AND (EQUAL (LESSP (PLUS '2
                              (PLUS (TIMES '8 J) (TIMES '128 I)))
                        '2048)
                 '*1*TRUE)
          (AND (EQUAL (LESSP (PLUS '3
                                   (PLUS (TIMES '8 J) (TIMES '128 I)))
                             '2048)
                      '*1*TRUE)
               (EQUAL (LESSP (PLUS '4
                                   (PLUS (TIMES '8 J) (TIMES '128 I)))
                             '2048)
                      '*1*TRUE)))))))))))
((ENABLE COMMUTATIVITY-OF-PLUS)
(ENABLE-THEORY GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable os-mbuffers-address-facts2.

Theorem: os-mbuffers-address-facts3 ((i < '16) ∧ (j < '16)) → ((((('16 ∗ j ) + i) < '256) = '*1*true)

∧ (((('8 ∗ (i + ('16 ∗ j ))) < '2048) = '*1*true)

∧ (((('8 ∗ (('16 ∗ j ) + i)) < '2048)

       = '*1*true)
       ∧ ((('2048

            < ('8

                 + ('8

∗ (('16 ∗ j ) + i))))

            = '*1*false)

∧ ((((('8 ∗ j ) + ('128 ∗ i))

                       < '2048)
                      = '*1*true)
                     ∧ ((('2048

                           < ('8

                               + ('8

∗ (i + ('16

∗ j )))))

                          = '*1*false)

∧ (((i + ('16 ∗ j ))

                              < '256)
                              = '*1*true)))))))

Event: Disable os-mbuffers-address-facts3.

Theorem: finite-numberp-getnth-from-current-mbuffer (good-tm (os) ∧ ((sid < '16) ∧ ((did < '16) ∧ (i < '8)))) → finite-numberp (getnth (i,

getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os)))),

                 '65536)

Theorem: finite-numberp-getnth-from-current-mbuffer1 (good-tm (os) ∧ ((sid < '16) ∧ ((did < '16) ∧ (i < '8)))) → ((getnth (i, getnth (('16 ∗ sid) + did, table ('8, os-mbuffers (os)))) ∈ N)

∧ (getnth (i,

getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os))))

         < '65536))

Event: Disable finite-numberp-getnth-from-current-mbuffer1.

Theorem: access-current-os-mbuffer-fields (good-os (os) ∧ ((sid < '16) ∧ (did < '16))) → ((getnth ('1,

getnth (('16 ∗ sid) + did, table ('8, os-mbuffers (os))))

      < '65535)

∧ ((getnth ('2,

getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os))))

          < '65535)

∧ (getnth ('3,

getnth (('16 ∗ sid) + did, table ('8, os-mbuffers (os))))

              < '65535)))

Event: Disable access-current-os-mbuffer-fields.

Theorem: lessp-plus-fact-for-mbuffers1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((sid < '16) ∧ (did < '16)))) → ((('4

+ ((('8 ∗ did) + ('128 ∗ sid))

+ getnth ('1,

getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os))))))

      < '2048)
     = '*1*true)

Event: Disable lessp-plus-fact-for-mbuffers1.

Theorem: lessp-plus-fact-for-mbuffers2 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((sid < '16) ∧ (did < '16))))

 → ((('503

+ ((('8 ∗ did) + ('128 ∗ sid))

+ getnth ('1,

getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os))))))

      < '65536)
     = '*1*true)

Event: Disable lessp-plus-fact-for-mbuffers2.

Theorem: index-within-length-of-mbuffer

 (if '4 < i then '*1*false

else '*1*true endif ∧ finite-number-queuep (getnth (('16 ∗ array-qfirst (os-readyq (os)))

+ (getnth ('2, tm-regs (os)) mod '16), table ('8, os-mbuffers (os))),

                       '4,
                       '65536))

→ (((i + getnth ('1,

getnth (('16 ∗ array-qfirst (os-readyq (os))) + (getnth ('2, tm-regs (os)) mod '16), table ('8, os-mbuffers (os)))))

      < '8)
     = '*1*true)

Event: Disable index-within-length-of-mbuffer.

Theorem: lessp-plus-fact-for-mbuffers-for-receive1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((sid < '16) ∧ (did < '16)))) → ((('4

+ ((('8 ∗ did) + ('128 ∗ sid))

+ getnth ('0,

getnth (did + ('16 ∗ sid),

table ('8, os-mbuffers (os))))))

      < '2048)
     = '*1*true)

Event: Disable lessp-plus-fact-for-mbuffers-for-receive1.

Theorem: lessp-plus-fact-for-mbuffers-for-receive2 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((sid < '16) ∧ (did < '16))))

 → ((('503

+ ((('8 ∗ did) + ('128 ∗ sid))

+ getnth ('0,

getnth (did + ('16 ∗ sid),

table ('8, os-mbuffers (os))))))

      < '65536)
     = '*1*true)

Event: Disable lessp-plus-fact-for-mbuffers-for-receive2.

Theorem: access-current-os-mbuffer-fields-for-receive (good-os (os) ∧ ((i < '16) ∧ (j < '16))) → ((getnth ('0, getnth (i + ('16 ∗ j ), table ('8, os-mbuffers (os))))

      < '65535)

∧ ((getnth ('2,

getnth (i + ('16 ∗ j ), table ('8, os-mbuffers (os))))

          < '65535)

∧ (getnth ('3,

getnth (i + ('16 ∗ j ),

table ('8, os-mbuffers (os))))

              < '65535)))

Event: Disable access-current-os-mbuffer-fields-for-receive.

Theorem: index-within-length-of-mbuffer-for-receive

(if '4 < i then '*1*false

else '*1*true endif ∧ finite-number-queuep (getnth (array-qfirst (os-readyq (os))

                             + ('16

∗ (getnth ('2, tm-regs (os))

mod '16)), table ('8, os-mbuffers (os))),

                       '4,
                       '65536))

→ (((i + getnth ('0,

getnth (array-qfirst (os-readyq (os))

                       + ('16

∗ (getnth ('2, tm-regs (os))

mod '16)), table ('8, os-mbuffers (os)))))

      < '8)
     = '*1*true)

Event: Disable index-within-length-of-mbuffer-for-receive.

Theorem: access-current-mbuffer ((sid < '16) ∧ ((did < '16) ∧ (i < '8))) → (getnth (i + (('8 ∗ did) + ('128 ∗ sid)), os-mbuffers (os))

= getnth (i, os-current-mbuffer (sid, did, os)))

Event: Disable access-current-mbuffer.

Theorem: contract-putnth-into-current-mbuffer (((i + getnth ('1, os-current-mbuffer (sid, did, os))) < '8) ∧ ((sid < '16) ∧ (did < '16))) → (putnth (value,

i + ((('8 ∗ did) + ('128 ∗ sid))

+ getnth ('1,

getnth (('16 ∗ sid) + did,

table ('8, os-mbuffers (os))))),

os-mbuffers (os)) = putseg (putnth (value,

i + getnth ('1, os-current-mbuffer (sid, did, os)), os-current-mbuffer (sid, did, os)),

('8 ∗ did) + ('128 ∗ sid), os-mbuffers (os)))

Event: Disable contract-putnth-into-current-mbuffer.

Theorem: associativity-of-plus-crock

 ('4

+ (('8 ∗ i)

+ (('128 ∗ j )

+ getnth (('8 ∗ i) + ('128 ∗ j ), os-mbuffers (os)))))

= (('8 ∗ i)

+ (('128 ∗ j )

         + ('4

+ getnth (('8 ∗ i) + ('128 ∗ j ), os-mbuffers (os)))))

Event: Disable associativity-of-plus-crock.

Theorem: contract-getnth-from-current-mbuffer-for-receive ((('4 + getnth ('0, os-current-mbuffer (sid, did, os))) < '8) ∧ ((sid < '16) ∧ (did < '16))) → (getnth ('4

+ ((('8 ∗ did) + ('128 ∗ sid))

+ getnth ('0,

getnth (did + ('16 ∗ sid),

table ('8, os-mbuffers (os))))),

os-mbuffers (os)) = getnth ('4 + getnth ('0, os-current-mbuffer (sid, did, os)), os-current-mbuffer (sid, did, os)))

Event: Disable contract-getnth-from-current-mbuffer-for-receive.

Theorem: access-current-mbuffer-qhead ((sid < '16) ∧ (did < '16)) → (getnth (('8 ∗ did) + ('128 ∗ sid), os-mbuffers (os))

= getnth ('0, os-current-mbuffer (sid, did, os)))

Event: Disable access-current-mbuffer-qhead.

Theorem: contract-putnth-into-current-mbuffer-for-receive1 ((i ∈ N) ∧ ((i < '4) ∧ ((sid < '16) ∧ (did < '16)))) → (putnth (value,

i + (('8 ∗ did) + ('128 ∗ sid)), os-mbuffers (os))

= putseg (putnth (value, i, os-current-mbuffer (sid, did, os)), ('8 ∗ did) + ('128 ∗ sid), os-mbuffers (os)))

Event: Disable contract-putnth-into-current-mbuffer-for-receive1.

Definition: os-mbuffers-with-enqueued-message (os) = putseg (array-enq (getnth ('3, tm-regs (os)),

os-current-mbuffer (array-qfirst (os-readyq (os)), getnth ('2, tm-regs (os)) mod '16, os)),

('8 ∗ (getnth ('2, tm-regs (os)) mod '16)) + ('128 ∗ array-qfirst (os-readyq (os))), os-mbuffers (os))

Theorem: length-os-mbuffers-with-enqueued-message length (os-mbuffers-with-enqueued-message (os)) = '2048

Event: Disable length-os-mbuffers-with-enqueued-message.

Theorem: plistp-os-mbuffers-with-enqueued-message plistp (os-mbuffers-with-enqueued-message (os))

Event: Disable plistp-os-mbuffers-with-enqueued-message.

Definition: os-mbuffers-with-dequeued-message (os) = putseg (array-deq (os-current-mbuffer (os-srcid (os, '16),

os-current-taskid (os),

os)),

('8 ∗ array-qfirst (os-readyq (os)))

+ ('128 ∗ (getnth ('2, tm-regs (os)) mod '16)), os-mbuffers (os))

Theorem: length-os-mbuffers-with-dequeued-message length (os-mbuffers-with-dequeued-message (os)) = '2048

Event: Disable length-os-mbuffers-with-dequeued-message.

Theorem: plistp-os-mbuffers-with-dequeued-message plistp (os-mbuffers-with-dequeued-message (os))

Event: Disable plistp-os-mbuffers-with-dequeued-message.

Theorem: correctness-of-array-qfullp-mbuffers-instance (array-queuep (queue) ∧ ('4 = getnth ('3, queue))) → (array-qfullp (queue) = qfullp (mapup-queue (queue), '4))

Event: Disable correctness-of-array-qfullp-mbuffers-instance.

Theorem: mapup-queue-getnth2-os-mbuffers ((i < '16) ∧ (j < '16)) → (mapup-queue (getnth2 (i, j , table ('16, table ('8, os-mbuffers (os)))))

= getnth2 (i, j , mapup-os-mbuffers (os)))

Event: Disable mapup-queue-getnth2-os-mbuffers.

Theorem: os-current-mbuffer-rewrite-to-getnth2 ((sid < '16) ∧ (did < '16)) → (getnth (('16 ∗ sid) + did, table ('8, os-mbuffers (os)))

= getnth2 (sid, did, table ('16, table ('8, os-mbuffers (os)))))

Event: Disable os-current-mbuffer-rewrite-to-getnth2.

Theorem: limited-associativity-of-plus2 (((1 + a) + b) + c) = ((1 + a) + (b + c))

Event: Disable limited-associativity-of-plus2.

Theorem: length-finite-number-queue-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → (length (queue) = '8)

Event: Disable length-finite-number-queue-corollary-for-ibuffers.

Theorem: plistp-finite-number-queue-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → plistp (queue)

Event: Disable plistp-finite-number-queue-corollary-for-ibuffers.

Theorem: array-queuep-finite-number-queue-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → array-queuep (queue)

Event: Disable array-queuep-finite-number-queue-corollary-for-ibuffers.

Theorem: finite-number-queue-qhead-size-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('0, queue) ∈ N) ∧ (getnth ('0, queue) < '4))

Event: Disable finite-number-queue-qhead-size-corollary-for-ibuffers.

Theorem: finite-number-queue-qtail-size-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('1, queue) ∈ N) ∧ (getnth ('1, queue) < '4))

Event: Disable finite-number-queue-qtail-size-corollary-for-ibuffers.

Theorem: finite-number-queue-qcurrlength-size-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('2, queue) ∈ N) ∧ (getnth ('2, queue) < '5))

Event: Disable finite-number-queue-qcurrlength-size-corollary-for-ibuffers.

Theorem: finite-number-queue-qmaxlength-value-corollary-for-ibuffers finite-number-queuep (queue, '4, '65536) → (getnth ('3, queue) = '4)

Event: Disable finite-number-queue-qmaxlength-value-corollary-for-ibuffers.

Theorem: finite-number-queuep-array-enq-finite-number-queue-corollary-for-ibuffers (finite-number-queuep (queue, '4, '65536) ∧ ((¬ array-qfullp (queue)) ∧ ((item ∈ N) ∧ (item < '65536)))) → finite-number-queuep (array-enq (item, queue), '4, '65536)

Event: Disable finite-number-queuep-array-enq-finite-number-queue-corollary-for-ibuffers.

Theorem: finite-number-queuep-array-deq-finite-number-queue-corollary-for-ibuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → finite-number-queuep (array-deq (queue), '4, '65536)

Event: Disable finite-number-queuep-array-deq-finite-number-queue-corollary-for-ibuffers.

Theorem: array-qfirst-finite-number-queue-corollary-for-ibuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) ∈ N) ∧ (array-qfirst (queue) < '65536))

Event: Disable array-qfirst-finite-number-queue-corollary-for-ibuffers.

Theorem: remainder-array-qfirst-finite-number-queue-corollary-for-ibuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) mod '65536) = array-qfirst (queue))

Event: Disable remainder-array-qfirst-finite-number-queue-corollary-for-ibuffers.

Event: Let us define the theory finite-number-queue-corollaries-for-ibuffers to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary-for-ibuffers, array-qfirst-finite-number-queue-corollary-for-ibuffers, finitenumber-queuep-array-deq-finite-number-queue-corollary-for-ibuffers, finite-number-queuep-array-enq-finite-number-queue-corollary-for-ibuffers, finite-number-queue-qmaxlength-value-corollary-for-ibuffers, finite-number-queue-qcurrlength-size-corollary-for-ibuffers, finite-number-queue-qtail-size-corollary-for-ibuffers, finite-number-queue-qhead-size-corollary-for-ibuffers, array-queuep-finite-number-queue-corollary-for-ibuffers, plistp-finite-number-queue-corollary-for-ibuffers, length-finite-number-queue-corollary-for-ibuffers.

Event: Let us define the theory finite-number-queue-corollaries-for-ibuffers1 to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary-for-ibuffers, array-qfirst-finite-number-queue-corollary-for-ibuffers, finitenumber-queuep-array-deq-finite-number-queue-corollary-for-ibuffers, finite-number-queuep-array-enq-finite-number-queue-corollary-for-ibuffers, finite-number-queue-qcurrlength-size-corollary-for-ibuffers, finite-number-queue-qtail-size-corollary-for-ibuffers, finite-number-queue-qhead-size-corollary-for-ibuffers, array-queuep-finite-number-queue-corollary-for-ibuffers, plistp-finite-number-queue-corollary-for-ibuffers, length-finite-number-queue-corollary-for-ibuffers.

Definition: os-ibuffers-address-plus-qtail-field = '244

Definition: os-ibuffers-address-plus-qcurrlength-field = '245

Definition: os-ibuffers-address-plus-qmaxlength-field = '246

Definition: os-ibuffers-address-plus-qarray-field = '247

Definition: os-current-ibuffer (id, os) = getnth (id, table ('8, os-ibuffers (os)))

Theorem: finite-number-queuep-current-ibuffer (good-os (os) ∧ (id < '16)) → finite-number-queuep (getnth (id, table ('8, os-ibuffers (os))),

                       '4,
                       '65536)

Event: Disable finite-number-queuep-current-ibuffer.

Theorem: finite-number-queuep-array-qreplace-corollary-for-ibuffers (finite-number-queuep (queue, '4, '65536) ∧ ((¬ array-qemptyp (queue)) ∧ finite-numberp (item, '65536))) → finite-number-queuep (array-qreplace (item, queue), '4, '65536)

Event: Disable finite-number-queuep-array-qreplace-corollary-for-ibuffers.

(PROVE-LEMMA
OS-IBUFFERS-ADDRESS-FACTS
(REWRITE)
(IMPLIES
 (LESSP I '16)
 (AND
  (EQUAL (LESSP (TIMES '8 I) '128)
         '*1*TRUE)
  (AND
   (EQUAL (LESSP '128 (PLUS '8 (TIMES '8 I)))
          '*1*FALSE)
   (AND
    (EQUAL (LESSP (TIMES '8 I) '65536)
           '*1*TRUE)
    (AND
     (EQUAL (LESSP (PLUS '243 (TIMES '8 I))
                   '65536)
            '*1*TRUE)
     (AND
      (EQUAL (LESSP (PLUS '244 (TIMES '8 I))
                    '65536)
             '*1*TRUE)
      (AND
        (EQUAL (LESSP (PLUS '245 (TIMES '8 I))
                      '65536)
               '*1*TRUE)
        (AND (EQUAL (LESSP (PLUS '246 (TIMES '8 I))
                           '65536)
                    '*1*TRUE)
             (AND (EQUAL (LESSP (PLUS '247 (TIMES '8 I))
                                '65536)
                         '*1*TRUE)
                  (AND (EQUAL (LESSP (PLUS '1 (TIMES '8 I)) '128)
                              '*1*TRUE)
                       (AND (EQUAL (LESSP (PLUS '2 (TIMES '8 I)) '128)
                                   '*1*TRUE)
                            (AND (EQUAL (LESSP (PLUS '3 (TIMES '8 I)) '128)
                                        '*1*TRUE)
                                 (EQUAL (LESSP (PLUS '4 (TIMES '8 I)) '128)
                                        '*1*TRUE)))))))))))))
((ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable os-ibuffers-address-facts.

Theorem: lessp-plus-facts-for-ibuffers (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (id < '16))) → (((('4

+ (('8 ∗ id)

+ getnth ('0, getnth (id, table ('8, os-ibuffers (os))))))

       < '128)
      = '*1*true)
     ∧ ((('247

+ (('8 ∗ id)

+ getnth ('0,

getnth (id, table ('8, os-ibuffers (os))))))

          < '65536)
          = '*1*true))

Event: Disable lessp-plus-facts-for-ibuffers.

Theorem: index-within-length-of-ibuffer

 (if '4 < i then '*1*false

else '*1*true endif ∧ finite-number-queuep (getnth (id, table ('8, os-ibuffers (os))),

                       '4,
                       '65536))

→ (((i + getnth ('0, getnth (id, table ('8, os-ibuffers (os))))) < '8)

     = '*1*true)

Event: Disable index-within-length-of-ibuffer.

Theorem: lessp-qmaxlength-field-os-current-ibuffer-tm-wordlub (good-tm (os) ∧ (id < '16)) → (getnth ('3, getnth (id, table ('8, os-ibuffers (os)))) < '65536)

Event: Disable lessp-qmaxlength-field-os-current-ibuffer-tm-wordlub.

Theorem: qreplace-address-fact (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (((('243

+ (('8 ∗ tm-interrupting-input-port (tm-iports (os)))

+ decr-mod (getnth ('1,

getnth (tm-interrupting-input-port (tm-iports (os)), table ('8, os-ibuffers (os)))),

'4)))

< '65536)
= '*1*true)

∧ (((('247

+ (('8 ∗ tm-interrupting-input-port (tm-iports (os))) + decr-mod (getnth ('1,

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8,

os-ibuffers (os)))),

'4)))

    < '65536)
   = '*1*true)

∧ ((('4

+ (('8 ∗ tm-interrupting-input-port (tm-iports (os))) + decr-mod (getnth ('1,

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8,

os-ibuffers (os)))),

'4)))

        < '128)
       = '*1*true)))

Event: Disable qreplace-address-fact.

Theorem: more-ibuffer-address-facts (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (((('243

+ (('8 ∗ tm-interrupting-input-port (tm-iports (os)))

+ getnth ('1,

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8, os-ibuffers (os))))))

< '65536)
= '*1*true)

∧ (((('247

+ (('8 ∗ tm-interrupting-input-port (tm-iports (os))) + getnth ('1,

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8, os-ibuffers (os))))))

    < '65536)
   = '*1*true)

∧ ((('4 + (('8

∗ tm-interrupting-input-port (tm-iports (os))) + getnth ('1,

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8,

os-ibuffers (os))))))

              < '128)
              = '*1*true)))

Event: Disable more-ibuffer-address-facts.

Theorem: access-current-ibuffer ((id < '16) ∧ (i < '8)) → (getnth (i + ('8 ∗ id), os-ibuffers (os))

= getnth (i, os-current-ibuffer (id, os)))

Event: Disable access-current-ibuffer.

Theorem: contract-getnth-from-current-ibuffer ((('4 + getnth ('0, os-current-ibuffer (id, os))) < '8) ∧ (id < '16)) → (getnth ('4

+ (('8 ∗ id)

+ getnth ('0,

getnth (id, table ('8, os-ibuffers (os))))),

os-ibuffers (os)) = getnth ('4 + getnth ('0, os-current-ibuffer (id, os)), os-current-ibuffer (id, os)))

Event: Disable contract-getnth-from-current-ibuffer.

Theorem: access-current-ibuffer-qhead (id < '16) → (getnth ('8 ∗ id, os-ibuffers (os))

= getnth ('0, os-current-ibuffer (id, os)))

Event: Disable access-current-ibuffer-qhead.

Theorem: contract-putnth-into-current-ibuffer ((i ∈ N) ∧ ((i < '4) ∧ (id < '16))) → (putnth (value, i + ('8 ∗ id), os-ibuffers (os))

= putseg (putnth (value, i, os-current-ibuffer (id, os)), '8 ∗ id, os-ibuffers (os)))

Event: Disable contract-putnth-into-current-ibuffer.

Theorem: contract-putnth-into-current-ibuffer1 (((i + decr-mod (getnth ('1, os-current-ibuffer (id, os)), '4)) < '8) ∧ (id < '16)) → (putnth (value,

i + (('8 ∗ id)

+ decr-mod (getnth ('1,

getnth (id,

table ('8,

os-ibuffers (os)))),

'4)),

os-ibuffers (os)) = putseg (putnth (value,

i + decr-mod (getnth ('1,

os-current-ibuffer (id, os)),

                                   '4),

os-current-ibuffer (id, os)), '8 ∗ id, os-ibuffers (os)))

Event: Disable contract-putnth-into-current-ibuffer1.

Theorem: contract-putnth-into-current-ibuffer2 (((i + getnth ('1, os-current-ibuffer (id, os))) < '8) ∧ (id < '16)) → (putnth (value,

i + (('8 ∗ id)

+ getnth ('1,

getnth (id, table ('8, os-ibuffers (os))))),

os-ibuffers (os)) = putseg (putnth (value,

i + getnth ('1, os-current-ibuffer (id, os)), os-current-ibuffer (id, os)),

'8 ∗ id,

os-ibuffers (os)))

Event: Disable contract-putnth-into-current-ibuffer2.

Definition: os-ibuffers-with-dequeued-character (os) = putseg (array-deq (os-current-ibuffer (os-current-taskid (os), os)),

'8 ∗ os-current-taskid (os), os-ibuffers (os))

Theorem: length-os-ibuffers-with-dequeued-character length (os-ibuffers-with-dequeued-character (os)) = '128

Event: Disable length-os-ibuffers-with-dequeued-character.

Theorem: plistp-os-ibuffers-with-dequeued-character plistp (os-ibuffers-with-dequeued-character (os))

Event: Disable plistp-os-ibuffers-with-dequeued-character.

Definition: os-ibuffers-with-qreplaced-overflow-character (os) = putseg (array-qreplace (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8, os-ibuffers (os)))),

'8 ∗ tm-interrupting-input-port (tm-iports (os)), os-ibuffers (os))

Theorem: length-os-ibuffers-with-qreplaced-overflow-character length (os-ibuffers-with-qreplaced-overflow-character (os)) = '128

Event: Disable length-os-ibuffers-with-qreplaced-overflow-character.

Theorem: plistp-os-ibuffers-with-qreplaced-overflow-character plistp (os-ibuffers-with-qreplaced-overflow-character (os))

Event: Disable plistp-os-ibuffers-with-qreplaced-overflow-character.

Definition: os-ibuffers-with-enqueued-overflow-character (os) = putseg (array-enq (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8, os-ibuffers (os)))),

'8 ∗ tm-interrupting-input-port (tm-iports (os)), os-ibuffers (os))

Theorem: length-os-ibuffers-with-enqueued-overflow-character length (os-ibuffers-with-enqueued-overflow-character (os)) = '128

Event: Disable length-os-ibuffers-with-enqueued-overflow-character.

Theorem: plistp-os-ibuffers-with-enqueued-overflow-character plistp (os-ibuffers-with-enqueued-overflow-character (os))

Event: Disable plistp-os-ibuffers-with-enqueued-overflow-character.

Definition: os-ibuffers-with-enqueued-character (os) = putseg (array-enq (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))), getnth (tm-interrupting-input-port (tm-iports (os)),

table ('8, os-ibuffers (os)))),

'8 ∗ tm-interrupting-input-port (tm-iports (os)), os-ibuffers (os))

Theorem: length-os-ibuffers-with-enqueued-character length (os-ibuffers-with-enqueued-character (os)) = '128

Event: Disable length-os-ibuffers-with-enqueued-character.

Theorem: plistp-os-ibuffers-with-enqueued-character plistp (os-ibuffers-with-enqueued-character (os))

Event: Disable plistp-os-ibuffers-with-enqueued-character.

Theorem: mapup-queue-getnth-for-ibuffers (good-os (os) ∧ (id < '16)) → (mapup-queue (getnth (id, table ('8, os-ibuffers (os))))

= getnth (id, mapup-os-ibuffers (os)))

Event: Disable mapup-queue-getnth-for-ibuffers.

Theorem: length-finite-number-queue-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → (length (queue) = '8)

Event: Disable length-finite-number-queue-corollary-for-obuffers.

Theorem: plistp-finite-number-queue-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → plistp (queue)

Event: Disable plistp-finite-number-queue-corollary-for-obuffers.

Theorem: array-queuep-finite-number-queue-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → array-queuep (queue)

Event: Disable array-queuep-finite-number-queue-corollary-for-obuffers.

Theorem: finite-number-queue-qhead-size-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('0, queue) ∈ N) ∧ (getnth ('0, queue) < '4))

Event: Disable finite-number-queue-qhead-size-corollary-for-obuffers.

Theorem: finite-number-queue-qtail-size-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('1, queue) ∈ N) ∧ (getnth ('1, queue) < '4))

Event: Disable finite-number-queue-qtail-size-corollary-for-obuffers.

Theorem: finite-number-queue-qcurrlength-size-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → ((getnth ('2, queue) ∈ N) ∧ (getnth ('2, queue) < '5))

Event: Disable finite-number-queue-qcurrlength-size-corollary-for-obuffers.

Theorem: finite-number-queue-qmaxlength-value-corollary-for-obuffers finite-number-queuep (queue, '4, '65536) → (getnth ('3, queue) = '4)

Event: Disable finite-number-queue-qmaxlength-value-corollary-for-obuffers.

Theorem: finite-number-queuep-array-enq-finite-number-queue-corollary-for-obuffers (finite-number-queuep (queue, '4, '65536) ∧ ((¬ array-qfullp (queue)) ∧ ((item ∈ N) ∧ (item < '65536)))) → finite-number-queuep (array-enq (item, queue), '4, '65536)

Event: Disable finite-number-queuep-array-enq-finite-number-queue-corollary-for-obuffers.

Theorem: finite-number-queuep-array-deq-finite-number-queue-corollary-for-obuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → finite-number-queuep (array-deq (queue), '4, '65536)

Event: Disable finite-number-queuep-array-deq-finite-number-queue-corollary-for-obuffers.

Theorem: array-qfirst-finite-number-queue-corollary-for-obuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) ∈ N) ∧ (array-qfirst (queue) < '65536))

Event: Disable array-qfirst-finite-number-queue-corollary-for-obuffers.

Theorem: remainder-array-qfirst-finite-number-queue-corollary-for-obuffers (finite-number-queuep (queue, '4, '65536) ∧ (¬ array-qemptyp (queue))) → ((array-qfirst (queue) mod '65536) = array-qfirst (queue))

Event: Disable remainder-array-qfirst-finite-number-queue-corollary-for-obuffers.

Event: Let us define the theory finite-number-queue-corollaries-for-obuffers to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary-for-obuffers, array-qfirst-finite-number-queue-corollary-for-obuffers, finitenumber-queuep-array-deq-finite-number-queue-corollary-for-obuffers, finite-number-queuep-array-enq-finite-number-queue-corollary-for-obuffers, finite-number-queue-qmaxlength-value-corollary-for-obuffers, finite-number-queue-qcurrlength-size-corollary-for-obuffers, finite-number-queue-qtail-size-corollary-for-obuffers, finite-number-queue-qhead-size-corollary-for-obuffers, array-queuep-finite-number-queue-corollary-for-obuffers, plistp-finite-number-queue-corollary-for-obuffers, length-finite-number-queue-corollary-for-obuffers.

Event: Let us define the theory finite-number-queue-corollaries-for-obuffers1 to consist of the following events: remainder-array-qfirst-finite-number-queue-corollary-for-obuffers, array-qfirst-finite-number-queue-corollary-for-obuffers, finitenumber-queuep-array-deq-finite-number-queue-corollary-for-obuffers, finite-number-queuep-array-enq-finite-number-queue-corollary-for-obuffers, finite-number-queue-qcurrlength-size-corollary-for-obuffers, finite-number-queue-qtail-size-corollary-for-obuffers, finite-number-queue-qhead-size-corollary-for-obuffers, array-queuep-finite-number-queue-corollary-for-obuffers, plistp-finite-number-queue-corollary-for-obuffers, length-finite-number-queue-corollary-for-obuffers.

Definition: os-obuffers-address-plus-qtail-field = '372

Definition: os-obuffers-address-plus-qcurrlength-field = '373

Definition: os-obuffers-address-plus-qmaxlength-field = '374

Definition: os-obuffers-address-plus-qarray-field = '375

Definition: os-current-obuffer (id, os) = getnth (id, table ('8, os-obuffers (os)))

Theorem: finite-number-queuep-current-obuffer (good-os (os) ∧ (id < '16)) → finite-number-queuep (getnth (id, table ('8, os-obuffers (os))),

                       '4,
                       '65536)

Event: Disable finite-number-queuep-current-obuffer.

(PROVE-LEMMA
OS-OBUFFERS-ADDRESS-FACTS
(REWRITE)
(IMPLIES
 (LESSP I '16)
 (AND
  (EQUAL (LESSP (TIMES '8 I) '65536)
         '*1*TRUE)
  (AND
   (EQUAL (LESSP (PLUS '371 (TIMES '8 I))
                 '65536)
          '*1*TRUE)
   (AND
    (EQUAL (LESSP (PLUS '372 (TIMES '8 I))
                  '65536)
           '*1*TRUE)
    (AND
        (EQUAL (LESSP (PLUS '373 (TIMES '8 I))
                      '65536)
               '*1*TRUE)
        (AND (EQUAL (LESSP (PLUS '374 (TIMES '8 I))
                           '65536)
                    '*1*TRUE)
             (AND (EQUAL (LESSP (PLUS '375 (TIMES '8 I))
                                '65536)
                         '*1*TRUE)
                  (AND (EQUAL (LESSP (PLUS '1 (TIMES '8 I)) '128)
                              '*1*TRUE)
                       (AND (EQUAL (LESSP (PLUS '2 (TIMES '8 I)) '128)
                                   '*1*TRUE)
                            (AND (EQUAL (LESSP (PLUS '3 (TIMES '8 I)) '128)
                                        '*1*TRUE)
                                 (EQUAL (LESSP (PLUS '4 (TIMES '8 I)) '128)
                                        '*1*TRUE)))))))))))
((ENABLE-THEORY GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable os-obuffers-address-facts.

Theorem: lessp-plus-facts-for-obuffers (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (id < '16))) → (((('4

+ (('8 ∗ id)

+ getnth ('1, getnth (id, table ('8, os-obuffers (os))))))

       < '128)
      = '*1*true)
     ∧ ((('375

+ (('8 ∗ id)

+ getnth ('1,

getnth (id, table ('8, os-obuffers (os))))))

          < '65536)
          = '*1*true))

Event: Disable lessp-plus-facts-for-obuffers.

Theorem: lessp-qmaxlength-field-os-current-obuffer-tm-wordlub (good-tm (os) ∧ (id < '16)) → (getnth ('3, getnth (id, table ('8, os-obuffers (os)))) < '65536)

Event: Disable lessp-qmaxlength-field-os-current-obuffer-tm-wordlub.

Theorem: obuffer-address-facts (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os)))

 → ((('375

+ (('8 ∗ tm-interrupting-output-port (tm-oports (os)))

+ getnth ('0,

getnth (tm-interrupting-output-port (tm-oports (os)),

table ('8, os-obuffers (os))))))

      < '65536)
     = '*1*true)

Event: Disable obuffer-address-facts.

Theorem: access-current-obuffer ((id < '16) ∧ (i < '8)) → (getnth (i + ('8 ∗ id), os-obuffers (os))

= getnth (i, os-current-obuffer (id, os)))

Event: Disable access-current-obuffer.

Theorem: contract-getnth-from-current-obuffer ((('4 + getnth ('1, os-current-obuffer (id, os))) < '8) ∧ (id < '16))

→ (getnth ('4

+ (('8 ∗ id)

+ getnth ('1,

getnth (id, table ('8, os-obuffers (os))))),

os-obuffers (os)) = getnth ('4 + getnth ('1, os-current-obuffer (id, os)), os-current-obuffer (id, os)))

Event: Disable contract-getnth-from-current-obuffer.

Theorem: contract-putnth-into-current-obuffer (((i + getnth ('1, os-current-obuffer (id, os))) < '8) ∧ (id < '16)) → (putnth (value,

i + (('8 ∗ id)

+ getnth ('1,

getnth (id, table ('8, os-obuffers (os))))),

os-obuffers (os)) = putseg (putnth (value,

i + getnth ('1, os-current-obuffer (id, os)), os-current-obuffer (id, os)),

'8 ∗ id,

os-obuffers (os)))

Event: Disable contract-putnth-into-current-obuffer.

Theorem: contract-putnth-into-current-obuffer1 ((i ∈ N) ∧ ((i < '4) ∧ (id < '16))) → (putnth (value, i + ('8 ∗ id), os-obuffers (os))

= putseg (putnth (value, i, os-current-obuffer (id, os)), '8 ∗ id, os-obuffers (os)))

Event: Disable contract-putnth-into-current-obuffer1.

Theorem: contract-getnth-from-current-obuffer1 ((('4 + getnth ('0, os-current-obuffer (id, os))) < '8) ∧ (id < '16)) → (getnth ('4

+ (('8 ∗ id)

+ getnth ('0,

getnth (id, table ('8, os-obuffers (os))))),

os-obuffers (os)) = getnth ('4 + getnth ('0, os-current-obuffer (id, os)), os-current-obuffer (id, os)))

Event: Disable contract-getnth-from-current-obuffer1.

Theorem: access-current-obuffer-qhead (id < '16) → (getnth ('8 ∗ id, os-obuffers (os))

= getnth ('0, os-current-obuffer (id, os)))

Event: Disable access-current-obuffer-qhead.

Definition: os-obuffers-with-enqueued-character (os) = putseg (array-enq (getnth ('3, tm-regs (os)),

os-current-obuffer (os-current-taskid (os), os)),

'8 ∗ os-current-taskid (os),

os-obuffers (os))

Theorem: length-os-obuffers-with-enqueued-character length (os-obuffers-with-enqueued-character (os)) = '128

Event: Disable length-os-obuffers-with-enqueued-character.

Theorem: plistp-os-obuffers-with-enqueued-character plistp (os-obuffers-with-enqueued-character (os))

Event: Disable plistp-os-obuffers-with-enqueued-character.

Definition: os-obuffers-with-dequeued-character (os) = putseg (array-deq (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)),

os)),

'8 ∗ tm-interrupting-output-port (tm-oports (os)), os-obuffers (os))

Theorem: length-os-obuffers-with-dequeued-character length (os-obuffers-with-dequeued-character (os)) = '128

Event: Disable length-os-obuffers-with-dequeued-character.

Theorem: plistp-os-obuffers-with-dequeued-character plistp (os-obuffers-with-dequeued-character (os))

Event: Disable plistp-os-obuffers-with-dequeued-character.

Theorem: restore-regs (good-os (os) ∧ (¬ tm-waiting (os))) → (getseg ('0,

           '8,

getseg ('9 ∗ array-qfirst (os-readyq (os)),

                 '9,

putseg (tm-cpu (os), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os))))

= tm-regs (os))

Event: Disable restore-regs.

Theorem: restore-regs1 (good-os (os) ∧ (¬ tm-waiting (os))) → (getseg ('0,

           '8,

getnth (array-qfirst (os-readyq (os)),

table ('9,

putseg (tm-cpu (os), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os)))))

= tm-regs (os))

Event: Disable restore-regs1.

Theorem: restore-cc (good-os (os) ∧ (¬ tm-waiting (os))) → ((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

putseg (tm-cpu (os), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os)))

mod '4) = tm-cc (os))

Event: Disable restore-cc.

Theorem: restore-error (good-os (os) ∧ (¬ tm-waiting (os))) → (((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

putseg (tm-cpu (os), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os)))

       mod '256)
      ÷ '4)

= tm-error (os))

Event: Disable restore-error.

Theorem: restore-svcflag (good-os (os) ∧ (¬ tm-waiting (os))) → (((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

putseg (tm-cpu (os), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os)))

       mod '512)
      ÷ '256)

= tm-svcflag (os))

Event: Disable restore-svcflag.

Theorem: restore-svcid (good-os (os) ∧ (¬ tm-waiting (os))) → ((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

putseg (tm-cpu (os), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os)))

      ÷ '512)

= tm-svcid (os))

Event: Disable restore-svcid.

Definition: os-task-table-with-delivered-character (os) = putseg (putnth (array-qfirst (getnth (os-current-taskid (os),

table ('8, os-ibuffers (os)))),

                 '3,

tm-cpu (os)), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os))

Theorem: length-os-task-table-with-delivered-character length (os-task-table-with-delivered-character (os)) = '144

Event: Disable length-os-task-table-with-delivered-character.

Theorem: plistp-os-task-table-with-delivered-character plistp (os-task-table-with-delivered-character (os))

Event: Disable plistp-os-task-table-with-delivered-character.

Theorem: restore-regs-for-tyi-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → (getseg ('0,

            '8,

getnth (array-qfirst (os-readyq (os)),

table ('9, os-task-table-with-delivered-character (os))))

= putnth (array-qfirst (getnth (os-current-taskid (os),

table ('8, os-ibuffers (os)))),

                '3,

tm-regs (os)))

Event: Disable restore-regs-for-tyi-svc-return.

Theorem: restore-cc-for-tyi-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → ((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

os-task-table-with-delivered-character (os)) mod '4) = tm-cc (os))

Event: Disable restore-cc-for-tyi-svc-return.

Theorem: restore-error-for-tyi-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → (((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

os-task-table-with-delivered-character (os))

       mod '256)
      ÷ '4)

= tm-error (os))

Event: Disable restore-error-for-tyi-svc-return.

Theorem: restore-svcid-for-tyi-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → ((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

os-task-table-with-delivered-character (os))

      ÷ '512)

= tm-svcid (os))

Event: Disable restore-svcid-for-tyi-svc-return.

Definition: os-task-table-with-delivered-message (os) = putseg (putnth (array-qfirst (getnth (array-qfirst (os-readyq (os))

                                  + ('16

∗ (getnth ('2,

tm-regs (os)) mod '16)), table ('8, os-mbuffers (os)))),

                 '3,

tm-cpu (os)), '9 ∗ array-qfirst (os-readyq (os)), os-task-table (os))

Theorem: length-os-task-table-with-delivered-message length (os-task-table-with-delivered-message (os)) = '144

Event: Disable length-os-task-table-with-delivered-message.

Theorem: plistp-os-task-table-with-delivered-message plistp (os-task-table-with-delivered-message (os))

Event: Disable plistp-os-task-table-with-delivered-message.

Theorem: restore-regs-for-receive-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → (getseg ('0,

            '8,

getnth (array-qfirst (os-readyq (os)),

table ('9, os-task-table-with-delivered-message (os))))

= putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

                '3,

tm-regs (os)))

Event: Disable restore-regs-for-receive-svc-return.

Theorem: restore-cc-for-receive-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → ((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

os-task-table-with-delivered-message (os)) mod '4) = tm-cc (os))

Event: Disable restore-cc-for-receive-svc-return.

Theorem: restore-error-for-receive-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → (((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

os-task-table-with-delivered-message (os))

       mod '256)
      ÷ '4)

= tm-error (os))

Event: Disable restore-error-for-receive-svc-return.

Theorem: restore-svcid-for-receive-svc-return (good-os (os) ∧ (¬ tm-waiting (os))) → ((getnth ('8 + ('9 ∗ array-qfirst (os-readyq (os))),

os-task-table-with-delivered-message (os))

      ÷ '512)

= tm-svcid (os))

Event: Disable restore-svcid-for-receive-svc-return.

Event: Let us define the theory executable-fns to consist of the following events: *1*greaterp, *1*leq, *1*geq, *1*member, *1*iff, *1*ord-lessp, *1*ordinalp, *1*assoc, *1*pairlist, *1*subrp, *1*apply-subr, *1*formals, *1*body, *1*fix-cost, *1*strip-cars, *1*sum-cdrs, *1*v&c$, *1*v&c-apply$, *1*eval$, *1*quantifierinitial-value, *1*add-to-set, *1*append, *1*max, *1*union, *1*quantifier-operation, *1*for, *1*exp, *1*divides, *1*number-and-list-induction, *1*double-number-induction, *1*double-number-double-list-induction, *1*lessp-quotient-induction, *1*min, *1*lessp-quotient-quotient-induction, *1*length, *1*insert, *1*occurrences, *1*remove, *1*permutation, *1*plistp, *1*setp, *1*sorted, *1*transitivityof-permutation-induction, *1*setp-permutation-induction, *1*getnth, *1*putnth, *1*getseg, *1*putseg, *1*fixlength, *1*firstn, *1*nthcdr, *1*getnth-getseg-induction, *1*integer-induction-instance, *1*getseg-putseg-induction, *1*nestedintervals, *1*strange-induction, *1*getnth2, *1*putnth2, *1*reverse, *1*finitenumberp, *1*number-listp, *1*finite-number-listp, *1*non-zero-listp, *1*tablep, *1*table, *1*flatten, *1*integer-nthcdr-induction, *1*finite-number-tablep, *1*nonlast, *1*incr-mod, *1*decr-mod, *1*qfirst, *1*enq, *1*deq, *1*qemptyp, *1*qfullp, *1*qreplace, *1*qhead-field, *1*qtail-field, *1*qcurrlength-field, *1*qmaxlengthfield, *1*qarray-field, *1*delta, *1*array-qindex-relation, *1*array-queuep, *1*arrayenq, *1*array-deq, *1*array-qfirst, *1*array-qfullp, *1*array-qemptyp, *1*arraynonlast, *1*array-qreplace, *1*delta-segment, *1*mapup-queue, *1*qfirst2, *1*enq2, *1*deq2, *1*qfullp2, *1*qemptyp2, *1*tm-wordsize, *1*tm-wordlub, *1*aluresult, *1*alu-value, *1*alu-carry, *1*tm-alu-decr, *1*tm-alu-decr-mod, *1*tmalu-difference, *1*tm-alu-incr, *1*tm-alu-incr-mod, *1*tm-alu-mod, *1*tm-alu-mult, *1*tm-alu-plus, *1*tm-incr, *1*tm-incrn, *1*tm-decr, *1*tm-shellp, *1*tmmemory, *1*tm-regs, *1*tm-cc, *1*tm-error, *1*tm-svcflag, *1*tm-svcid, *1*tmbase, *1*tm-limit, *1*tm-slimit, *1*tm-svmode, *1*tm-rwstate, *1*tm-clock, *1*tm-iports, *1*tm-oports, *1*tm-regsize, *1*tm-charsize, *1*tm-ccsize, *1*tmerrorsize, *1*tm-svcflagsize, *1*tm-svcidsize, *1*tm-cclub, *1*tm-errorlub, *1*tmsvcflaglub, *1*tm-svcidlub, *1*tm-reglength, *1*tm-memlength, *1*tm-charlub, *1*tm-port-length, *1*tm-pc-address, *1*tm-sp-address, *1*tm-set-memory, *1*tmset-regs, *1*tm-set-cc, *1*tm-set-error, *1*tm-set-svcflag, *1*tm-set-svcid, *1*tmset-base, *1*tm-set-limit, *1*tm-set-slimit, *1*tm-set-svmode, *1*tm-set-rwstate, *1*tm-set-clock, *1*tm-set-iports, *1*tm-set-oports, *1*tm-pc, *1*tm-set-pc, *1*tm-sp, *1*tm-set-sp, *1*tm-non-zero-no-carry-condition, *1*tm-zero-no-carry-condition, *1*tm-non-zero-carry-condition, *1*tm-zero-carry-condition, *1*tmcc-value, *1*tm-cc-divisor, *1*tm-error-divisor, *1*tm-svcflag-divisor, *1*tmpack-psw, *1*tm-unpack-cc, *1*tm-unpack-error, *1*tm-unpack-svcflag, *1*tmunpack-svcid, *1*tm-register-save-area-addr, *1*tm-clock-new-pc-addr, *1*tmerror-new-pc-addr, *1*tm-svc-new-pc-addr, *1*tm-input-new-pc-addr, *1*tmoutput-new-pc-addr, *1*tm-svcid-addr, *1*tm-input-devid-addr, *1*tm-input-char-addr, *1*tm-output-devid-addr, *1*tm-no-error, *1*tm-halt-status, *1*tmopcode-error, *1*tm-privilege-error, *1*tm-stack-overflow-error, *1*tm-stack-underflow-error, *1*tm-address-error, *1*tm-pc-address-error, *1*tm-supervisor-mode, *1*tm-user-mode, *1*tm-in-supervisor-mode, *1*tm-wait-state, *1*tmrun-state, *1*tm-waiting, *1*tm-svc, *1*tm-no-svc, *1*tm-cleared-svcflag, *1*tmiportp, *1*tm-iinterrupt-flag, *1*tm-ierror-flag, *1*tm-ichar, *1*tm-oportp, *1*tmointerrupt-flag, *1*tm-obusy-flag, *1*tm-ochar, *1*tm-iport-errorp, *1*tm-clear-input-interrupt, *1*tm-post-input-interrupt, *1*tm-oport-idlep, *1*tm-start-output, *1*tm-post-output-interrupt, *1*tm-clear-output-interrupt, *1*real-addr, *1*realaddr-source, *1*real-addr-num, *1*tm-arg-mode, *1*tm-arg-datum, *1*tm-arg-index, *1*tm-fix-word, *1*tm-fix-reg-address, *1*tm-compute-address, *1*tmgood-address, *1*tm-incr-address, *1*tm-incrn-address, *1*tm-fetch-from-memory, *1*tm-store-in-memory, *1*tm-fetch-from-regmem, *1*tm-store-in-regmem, *1*tmfetch, *1*tm-store, *1*tm-stack-overflowp, *1*tm-stack-underflowp, *1*tm-execute-add, *1*tm-execute-branch, *1*tm-execute-branch-on-zero, *1*tm-execute-branch-not-zero, *1*tm-execute-call, *1*tm-execute-compare, *1*tm-execute-decr, *1*tmexecute-decr-mod, *1*tm-execute-incr, *1*tm-execute-incr-mod, *1*tm-execute-load-base, *1*tm-execute-load-limit, *1*tm-execute-load-psw, *1*tm-execute-mod, *1*tm-execute-move, *1*tm-execute-multiply, *1*tm-execute-post-output-interrupt, *1*tm-execute-return, *1*tm-execute-run, *1*tm-execute-set-clock, *1*tm-execute-start-output, *1*tm-execute-svc, *1*tm-execute-svc-return, *1*tmexecute-test-iport, *1*tm-execute-test-oport, *1*tm-execute-wait, *1*tm-opcode-size, *1*tm-mode-size, *1*tm-index-size, *1*tm-opcode-divisor, *1*tm-mode1-divisor, *1*tm-index1-divisor, *1*tm-mode2-divisor, *1*tm-opcode, *1*tm-mode1, *1*tm-index1, *1*tm-mode2, *1*tm-index2, *1*tm-nullary-instructionp, *1*tmunary-instructionp, *1*tm-datum1, *1*tm-datum2, *1*tm-arg1, *1*tm-arg2, *1*tm-return-opcode, *1*tm-wait-opcode, *1*tm-run-opcode, *1*tm-execute-nullary, *1*tm-br-opcode, *1*tm-brnz-opcode, *1*tm-brz-opcode, *1*tm-call-opcode, *1*tm-decr-opcode, *1*tm-incr-opcode, *1*tm-lbase-opcode, *1*tmllimit-opcode, *1*tm-lpsw-opcode, *1*tm-post-opcode, *1*tm-svc-opcode, *1*tmsvc-return-opcode, *1*tm-testi-opcode, *1*tm-testo-opcode, *1*tm-time-opcode, *1*tm-execute-unary, *1*tm-add-opcode, *1*tm-compare-opcode, *1*tm-decr-mod-opcode, *1*tm-incr-mod-opcode, *1*tm-mod-opcode, *1*tm-move-opcode, *1*tm-mult-opcode, *1*tm-stout-opcode, *1*tm-execute-binary, *1*tm-execute-instruction, *1*tm-fetch-opcode, *1*tm-fetch-arg1, *1*tm-fetch-arg2, *1*tmexecute, *1*tm-decrement-clock, *1*tm-good-pc-address, *1*tm-fetch-execute, *1*tm-fetch-new-pc-on-interrupt, *1*tm-store-old-psw-on-interrupt, *1*tm-clock-interruptp, *1*tm-execute-clock-interrupt, *1*tm-errorp, *1*tm-execute-error-interrupt, *1*tm-svc-interruptp, *1*tm-store-svcid-on-interrupt, *1*tm-execute-svc-interrupt, *1*tm-overflow-char, *1*tm-some-input-interruptp, *1*tm-input-interruptp, *1*tm-interrupting-input-port, *1*tm-store-interrupting-input-device, *1*tm-execute-input-interrupt, *1*tm-some-output-interruptp, *1*tm-output-interruptp, *1*tm-interrupting-output-port, *1*tm-store-interrupting-output-device, *1*tm-execute-output-interrupt, *1*tm-device-input-eventp, *1*tm-idevid, *1*tmidatum, *1*tm-device-output-eventp, *1*tm-odevid, *1*tm-post-interrupt, *1*tmstep, *1*tm-processor.

Definition: os-intended-clock-interrupt (tm) = tm-set-memory (putnth (tm-pc (tm),

                        '0,

putnth (tm-sp (tm),

                               '1,

putnth (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                                     '2,

putseg (os-task-table (tm),

                                            '15,

putseg (os-segment-table (tm),

                                                  '159,

putseg (os-readyq (tm),

                                                         '191,

putseg (os-code (tm),

                                                               '2547,

tm-memory (tm)))))))), tm-set-pc ('2654,

tm-set-sp ('3310,

tm-set-svmode ('1,

tm-set-error ('0,

tm-set-rwstate ('0, tm))))))

Theorem: equivalence-of-clock-interrupt-expressions (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-execute-clock-interrupt (os) = os-intended-clock-interrupt (os))

Event: Disable equivalence-of-clock-interrupt-expressions.

Definition: os-time-for-clock-interrupt-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-CLOCK-INTERRUPT-HANDLER-THRU-SAVE-STATE
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
              (OS-NEW-TASK-TABLE OS)

            (PUTSEG (OS-SEGMENT-TABLE OS)
                    '159
                    (PUTSEG (OS-READYQ OS)
                            '191
                            (PUTSEG (OS-CODE OS)
                                    '2547
                                    (PUTNTH '2558
                                            '3309
                                            (PUTNTH '2656
                                                    '3310
                                                    (TM-MEMORY OS))))))))))))
(PUTNTH '2656
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (TM-R2 OS)
                        '2
                        (PUTNTH (TM-R3 OS)
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15
                                (TIMES '9
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '8))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-clock-interrupt-handler-thru-save-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-clock-interrupt (os),

os-time-for-clock-interrupt-handler-thru-save-state (os))

= os-clock-interrupt-handler-thru-save-state (os))

Event: Disable trace-clock-interrupt-handler-thru-save-state.

Definition: os-time-for-clock-interrupt-handler-to-dispatcher (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-CLOCK-INTERRUPT-HANDLER-TO-DISPATCHER
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
              (OS-NEW-TASK-TABLE OS)
              '15
              (PUTSEG (OS-SEGMENT-TABLE OS)
                      '159
                      (PUTSEG (ARRAY-ENQ (ARRAY-QFIRST (OS-READYQ OS))
                                         (ARRAY-DEQ (OS-READYQ OS)))
                              '191
                              (PUTSEG (OS-CODE OS)
                                      '2547
                                      (PUTNTH '2558
                                              '3309
                                              (PUTNTH '2665
                                                      '3310
                                                      (TM-MEMORY OS))))))))))))
  (PUTNTH '3206

   (PUTNTH '3310
           '1
           (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                   '2
                   (PUTNTH '191
                           '3
                           (PUTNTH (PLUS '195
                                         (GETNTH '1
                                                 (ARRAY-DEQ (OS-READYQ OS))))
                                   '4
                                   (TM-REGS OS))))))
(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1
                                      (ARRAY-DEQ (OS-READYQ OS)))
                              '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-clock-interrupt-handler-to-dispatcher (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-clock-interrupt-handler-thru-save-state (os),

os-time-for-clock-interrupt-handler-to-dispatcher (os))

= os-clock-interrupt-handler-to-dispatcher (os))

Event: Disable trace-clock-interrupt-handler-to-dispatcher.

Definition: os-time-for-clock-interrupt-handler-to-restore-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick)

(DEFN OS-CLOCK-INTERRUPT-HANDLER-TO-RESTORE-STATE

(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
             (TM-ERROR OS)
             (TM-SVCFLAG OS)
             (TM-SVCID OS))
'2
(PUTNTH
 (TM-R2 OS)
 '13
 (PUTNTH
  (TM-R3 OS)
  '14
  (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG (OS-SEGMENT-TABLE OS)
                 '159
                 (PUTSEG (ARRAY-ENQ (ARRAY-QFIRST (OS-READYQ OS))
                                    (ARRAY-DEQ (OS-READYQ OS)))
                         '191
                         (PUTSEG (OS-CODE OS)
                                 '2547
                                 (PUTNTH '2558
                                         '3309
                                         (PUTNTH '3217
                                                 '3310
                                                 (TM-MEMORY OS))))))))))))
(PUTNTH '2601
'0
(PUTNTH '3309
        '1
        (PUTNTH (ARRAY-QFIRST (ARRAY-ENQ (ARRAY-QFIRST (OS-READYQ OS))
                                         (ARRAY-DEQ (OS-READYQ OS))))
                '2
                (PUTNTH '191
                        '3

                           (PUTNTH (PLUS '195
                                         (GETNTH '1
                                                 (ARRAY-DEQ (OS-READYQ OS))))
                                   '4
                                   (TM-REGS OS))))))
(TM-CC-VALUE (TM-ALU-PLUS '195
                          (GETNTH '0
                                  (ARRAY-ENQ (ARRAY-QFIRST (OS-READYQ OS))
                                             (ARRAY-DEQ (OS-READYQ OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-clock-interrupt-handler-to-restore-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-clock-interrupt-handler-to-dispatcher (os),

os-time-for-clock-interrupt-handler-to-restore-state (os))

= os-clock-interrupt-handler-to-restore-state (os))

Event: Disable trace-clock-interrupt-handler-to-restore-state.

Definition: os-clock-new-readyq (os) = array-enq (array-qfirst (os-readyq (os)), array-deq (os-readyq (os)))

Definition: os-time-for-clock-interrupt-handler-to-finish (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick)

(DEFN OS-CLOCK-INTERRUPT-HANDLER
(OS)

(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS)))
         (OS-NEW-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))))
          (OS-NEW-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8
                 (TIMES '9
                        (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '2
   (PUTNTH
    (TM-R2 OS)
    '13
    (PUTNTH
     (TM-R3 OS)
     '14
     (PUTSEG
            (OS-NEW-TASK-TABLE OS)
            '15
            (PUTSEG (OS-SEGMENT-TABLE OS)
                    '159
                    (PUTSEG (OS-CLOCK-NEW-READYQ OS)
                            '191
                            (PUTSEG (OS-CODE OS)
                                    '2547
                                    (PUTNTH '2558
                                            '3309
                                            (PUTNTH '3217
                                                    '3310
                                                    (TM-MEMORY OS))))))))))))
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
             OS)
(OS-NEW-CC (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
              OS)

  (OS-NEW-SVCFLAG (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
                  OS)
  (OS-NEW-SVCID (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
                OS)
  (OS-NEW-BASE (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
               OS)
  (OS-NEW-LIMIT (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
                OS)
  (TM-SLIMIT OS)
  '0
  '0
  '1000
  (TM-IPORTS OS)
  (TM-OPORTS OS))
 NIL)

Theorem: trace-clock-interrupt-handler-to-finish (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-clock-interrupt-handler-to-restore-state (os),

os-time-for-clock-interrupt-handler-to-finish (os))

= os-clock-interrupt-handler (os))

Event: Disable trace-clock-interrupt-handler-to-finish.

Definition: os-cih-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

Definition: os-cih-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

Definition: os-time-for-clock-interrupt-handler (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick

      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Theorem: rewrite-clock-trace1 tm-processor (os-intended-clock-interrupt (os),

os-time-for-clock-interrupt-handler (os))

= tm-processor (tm-processor (os-intended-clock-interrupt (os),

os-time-for-clock-interrupt-handler-thru-save-state (os)),

os-cih-time1 (os))

Event: Disable rewrite-clock-trace1.

Theorem: rewrite-clock-trace2 tm-processor (os-clock-interrupt-handler-thru-save-state (os), os-cih-time1 (os)) = tm-processor (tm-processor (os-clock-interrupt-handler-thru-save-state (os),

os-time-for-clock-interrupt-handler-to-dispatcher (os)),

os-cih-time2 (os))

Event: Disable rewrite-clock-trace2.

Theorem: rewrite-clock-trace3 tm-processor (os-clock-interrupt-handler-to-dispatcher (os), os-cih-time2 (os)) = tm-processor (tm-processor (os-clock-interrupt-handler-to-dispatcher (os),

os-time-for-clock-interrupt-handler-to-restore-state (os)),

os-time-for-clock-interrupt-handler-to-finish (os))

Event: Disable rewrite-clock-trace3.

Theorem: trace-clock-interrupt-handler (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-clock-interrupt (os),

os-time-for-clock-interrupt-handler (os))

= os-clock-interrupt-handler (os))

Event: Disable trace-clock-interrupt-handler.

Definition: os-intended-error-interrupt (tm) = tm-set-memory (putnth (tm-pc (tm), putnth (tm-sp (tm),

                               '1,

putnth (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                                     '2,

putseg (os-task-table (tm),

                                            '15,

putseg (os-segment-table (tm),

                                                  '159,

putseg (os-readyq (tm),

                                                         '191,

putseg (os-status-table (tm),

                                                               '211,

putseg (os-code (tm),

                                                                      '2547,

tm-memory (tm))))))))),

tm-set-pc ('2667,

tm-set-sp ('3310,

tm-set-svmode ('1,

tm-set-error ('0,

tm-set-rwstate ('0, tm))))))

Theorem: equivalence-of-error-interrupt-expressions (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-execute-error-interrupt (os) = os-intended-error-interrupt (os))

Event: Disable equivalence-of-error-interrupt-expressions.

Definition: os-time-for-error-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-ERROR-HANDLER-THRU-SAVE-STATE
 (OS)
 (TM
  (PUTNTH

(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG (OS-READYQ OS)
   '191
   (PUTSEG (OS-STATUS-TABLE OS)
           '211
           (PUTSEG (OS-CODE OS)
                   '2547
                   (PUTNTH '2558
                           '3309
                           (PUTNTH '2669
                                   '3310
                                   (TM-MEMORY OS)))))))))))))
(PUTNTH '2669
'0
(PUTNTH '3310
'1
(PUTNTH (TM-R2 OS)
        '2
        (PUTNTH (TM-R3 OS)
                '3
                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15

                                (TIMES '9
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '8))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-error-handler-thru-save-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-thru-save-state (os))

= os-error-handler-thru-save-state (os))

Event: Disable trace-error-handler-thru-save-state.

Definition: os-time-for-error-handler-to-dispatcher (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick)

(DEFN OS-ERROR-HANDLER-TO-DISPATCHER
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)

                (TM-SVCID OS))
   '2
   (PUTNTH
    (TM-R2 OS)
    '13
    (PUTNTH
     (TM-R3 OS)
     '14
     (PUTSEG
      (OS-NEW-TASK-TABLE OS)
      '15
      (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG (ARRAY-DEQ (OS-READYQ OS))
                   '191
                   (PUTSEG (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                             '1
                                             '0
                                             OS)
                           '211
                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '2558
                                           '3309
                                           (PUTNTH '2676
                                                   '3310
                                                   (TM-MEMORY OS)))))))))))))
(PUTNTH '3206
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (PLUS '211
                              (TIMES '2
                                     (ARRAY-QFIRST (OS-READYQ OS))))
                        '2
                        (PUTNTH '191 '3 (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '2
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '211))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)

(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-error-handler-to-dispatcher (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-error-handler-thru-save-state (os),

os-time-for-error-handler-to-dispatcher (os))

= os-error-handler-to-dispatcher (os))

Event: Disable trace-error-handler-to-dispatcher.

Definition: os-time-for-error-handler-to-wait-state (os)

= '(tick tick tick tick tick tick)

(DEFN OS-ERROR-HANDLER-PATH1
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2
   (PUTNTH
    (TM-R2 OS)
    '13
    (PUTNTH
     (TM-R3 OS)
     '14

     (PUTSEG
      (OS-NEW-TASK-TABLE OS)
      '15
      (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG (ARRAY-DEQ (OS-READYQ OS))
                   '191
                   (PUTSEG (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                             '1
                                             '0
                                             OS)
                           '211
                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '2558
                                           '3309
                                           (PUTNTH '3211
                                                   '3310
                                                   (TM-MEMORY OS)))))))))))))
(PUTNTH '3222
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (PLUS '211
                              (TIMES '2
                                     (ARRAY-QFIRST (OS-READYQ OS))))
                        '2
                        (PUTNTH '191 '3 (TM-REGS OS)))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-error-handler-to-wait-state (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (tm-processor (os-error-handler-to-dispatcher (os),

os-time-for-error-handler-to-wait-state (os))

= os-error-handler-path1 (os))

Event: Disable trace-error-handler-to-wait-state.

Definition: os-time-for-error-handler-to-restore-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick)

(DEFN OS-ERROR-HANDLER-TO-RESTORE-STATE
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
             (OS-SEGMENT-TABLE OS)
             '159
             (PUTSEG (ARRAY-DEQ (OS-READYQ OS))
                     '191

                   (PUTSEG (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                             '1
                                             '0
                                             OS)
                           '211
                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '2558
                                           '3309
                                           (PUTNTH '3217
                                                   '3310
                                                   (TM-MEMORY OS)))))))))))))
(PUTNTH '2601
        '0
        (PUTNTH '3309
                '1
                (PUTNTH (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                        '2
                        (PUTNTH '191 '3 (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS '195
                          (GETNTH '0
                                  (ARRAY-DEQ (OS-READYQ OS)))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-error-handler-to-restore-state (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-error-handler-to-dispatcher (os),

os-time-for-error-handler-to-restore-state (os))

= os-error-handler-to-restore-state (os))

Event: Disable trace-error-handler-to-restore-state.

Definition: os-time-for-error-handler-to-finish (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

(DEFN OS-ERROR-HANDLER-PATH2
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
            (OS-NEW-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
             (OS-NEW-TASK-TABLE OS))
     '2
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
             (OS-SEGMENT-TABLE OS)
             '159
             (PUTSEG (ARRAY-DEQ (OS-READYQ OS))
                     '191
                     (PUTSEG (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                               '1

                                             OS)
                           '211
                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '2558
                                           '3309
                                           (PUTNTH '3217
                                                   '3310
                                                   (TM-MEMORY OS)))))))))))))
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-BASE (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-LIMIT (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-error-handler-to-finish (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-error-handler-to-restore-state (os),

os-time-for-error-handler-to-finish (os))

= os-error-handler-path2 (os))

Event: Disable trace-error-handler-to-finish.

Definition: os-error-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick)

Definition: os-time-for-error-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Theorem: rewrite-error-trace1 tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-path1 (os))

= tm-processor (tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-thru-save-state (os)),

os-error-time1 (os))

Event: Disable rewrite-error-trace1.

Theorem: rewrite-error-trace2 tm-processor (os-error-handler-thru-save-state (os), os-error-time1 (os)) = tm-processor (tm-processor (os-error-handler-thru-save-state (os),

os-time-for-error-handler-to-dispatcher (os)),

os-time-for-error-handler-to-wait-state (os))

Event: Disable rewrite-error-trace2.

Theorem: trace-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-path1 (os))

= os-error-handler-path1 (os))

Event: Disable trace-error-handler-path1.

Definition: os-error-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

Definition: os-error-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

Definition: os-time-for-error-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick)

Theorem: rewrite-error-trace3 tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-path2 (os))

= tm-processor (tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-thru-save-state (os)),

os-error-time2 (os))

Event: Disable rewrite-error-trace3.

Theorem: rewrite-error-trace4 tm-processor (os-error-handler-thru-save-state (os), os-error-time2 (os)) = tm-processor (tm-processor (os-error-handler-thru-save-state (os),

os-time-for-error-handler-to-dispatcher (os)),

os-error-time3 (os))

Event: Disable rewrite-error-trace4.

Theorem: rewrite-error-trace5 tm-processor (os-error-handler-to-dispatcher (os), os-error-time3 (os)) = tm-processor (tm-processor (os-error-handler-to-dispatcher (os),

os-time-for-error-handler-to-restore-state (os)),

os-time-for-error-handler-to-finish (os))

Event: Disable rewrite-error-trace5.

Theorem: trace-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler-path2 (os))

= os-error-handler-path2 (os))

Event: Disable trace-error-handler-path2.

Definition: os-time-for-error-handler (os) = if array-qemptyp (array-deq (os-readyq (os)))

then os-time-for-error-handler-path1 (os) else os-time-for-error-handler-path2 (os) endif

Definition: os-error-handler (os) = if array-qemptyp (array-deq (os-readyq (os)))

then os-error-handler-path1 (os) else os-error-handler-path2 (os) endif

Theorem: trace-os-error-handler (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-error-interrupt (os),

os-time-for-error-handler (os))

= os-error-handler (os))

Event: Disable trace-os-error-handler.

Definition: os-intended-svc-send-interrupt (tm) = tm-set-memory (putnth (tm-pc (tm),

                        '0,

putnth (tm-sp (tm),

                               '1,

putnth (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                                     '2,

putnth (tm-svcid (tm),

                                            '8,

putseg (os-task-table (tm),

                                                   '15,

putseg (os-segment-table (tm),

                                                         '159,

putseg (os-readyq (tm),

                                                                '191,

putseg (os-status-table (tm),

                                                                      '211,

putseg (os-mbuffers (tm),

                                                                             '499,

putseg (os-code (tm),

                                                                                   '2547,

tm-memory (tm))))))))))),

tm-set-pc ('2690,

tm-set-sp ('3310,

tm-set-svmode ('1,

tm-set-error ('0,

tm-set-rwstate ('0, tm))))))

Theorem: equivalence-of-svc-send-interrupt-expressions (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-execute-svc-interrupt (os) = os-intended-svc-send-interrupt (os))

Event: Disable equivalence-of-svc-send-interrupt-expressions.

Definition: os-time-for-svc-send-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-THRU-SAVE-STATE
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)

        (TM-SVCFLAG OS)
        (TM-SVCID OS))
'2
(PUTNTH
(TM-SVCID OS)
'8
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (OS-READYQ OS)
 '191
 (PUTSEG (OS-STATUS-TABLE OS)
         '211
         (PUTSEG (OS-MBUFFERS OS)
                 '499
                 (PUTSEG (OS-CODE OS)
                         '2547
                         (PUTNTH '2558
                                 '3309
                                 (PUTNTH '2692
                                         '3310
                                         (TM-MEMORY OS)))))))))))))))
(PUTNTH '2692
'0
(PUTNTH '3310
        '1
        (PUTNTH (TM-R2 OS)
                '2
                (PUTNTH (TM-R3 OS)
                        '3
                        (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15
                        (TIMES '9
                               (ARRAY-QFIRST (OS-READYQ OS))))

'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-thru-save-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-thru-save-state (os))

= os-svc-send-handler-thru-save-state (os))

Event: Disable trace-svc-send-handler-thru-save-state.

Definition: os-time-for-svc-send-handler-to-qfullp-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-TO-QFULLP-TEST
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2

(PUTNTH '0
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
      (OS-STATUS-TABLE OS)
      '211
      (PUTSEG (OS-MBUFFERS OS)
              '499
              (PUTSEG (OS-CODE OS)
                      '2547
                      (PUTNTH '2558
                              '3309
                              (PUTNTH '2726
                                      '3310
                                      (TM-MEMORY OS))))))))))))))))
(PUTNTH '2747
'0
(PUTNTH '3310
'1
(PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
        '2
        (PUTNTH (PLUS '499
                      (PLUS (TIMES '8
                                   (REMAINDER (TM-R2 OS) '16))
                            (TIMES '128
                                   (ARRAY-QFIRST (OS-READYQ OS)))))
                '3

                          (PUTNTH (TIMES '8
                                         (REMAINDER (TM-R2 OS) '16))
                                  '4
                                  (PUTNTH (REMAINDER (TM-R2 OS) '16)
                                          '6
                                          (PUTNTH (TM-R3 OS)
                                                  '7
                                                  (TM-REGS OS))))))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS (TIMES '8
                                       (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                  '16))
                                (TIMES '128
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '499))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-qfullp-test (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '0))) → (tm-processor (os-svc-send-handler-thru-save-state (os),

os-time-for-svc-send-handler-to-qfullp-test (os))

= os-svc-send-handler-to-qfullp-test (os))

Event: Disable trace-svc-send-handler-to-qfullp-test.

Definition: os-time-for-svc-send-handler-to-dispatcher (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-TO-DISPATCHER
(OS)

(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '0
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-DEQ (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                  '2
                  (OS-DESTID OS '16)
                  OS)
'211
(PUTSEG (OS-MBUFFERS OS)
        '499
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558

                                        (PUTNTH '2796
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
         '1
         (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                 '2
                 (PUTNTH (PLUS '211
                               (TIMES '2
                                      (ARRAY-QFIRST (OS-READYQ OS))))
                         '3
                         (PUTNTH (TIMES '8
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                 '4
                                 (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)
                                         '6
                                         (PUTNTH (GETNTH '3 (TM-REGS OS))
                                                 '7
                                                 (TM-REGS OS))))))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '2
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '211))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-dispatcher (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os)))))

→ (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-to-dispatcher (os))

= os-svc-send-handler-to-dispatcher (os))

Event: Disable trace-svc-send-handler-to-dispatcher.

Definition: os-time-for-svc-send-handler-to-wait-state (os)

= '(tick tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-PATH1
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '0
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-NEW-TASK-TABLE OS)
          '15

        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (ARRAY-DEQ (OS-READYQ OS))
          '191
          (PUTSEG
                (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                  '2
                                  (OS-DESTID OS '16)
                                  OS)
                '211
                (PUTSEG (OS-MBUFFERS OS)
                        '499
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3211
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
         '1
         (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                 '2
                 (PUTNTH '191
                         '3
                         (PUTNTH (TIMES '8
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                 '4
                                 (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)
                                         '6
                                         (PUTNTH (GETNTH '3 (TM-REGS OS))
                                                 '7
                                                 (TM-REGS OS))))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)

(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-wait-state (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (tm-processor (os-svc-send-handler-to-dispatcher (os),

os-time-for-svc-send-handler-to-wait-state (os))

= os-svc-send-handler-path1 (os))

Event: Disable trace-svc-send-handler-to-wait-state.

Definition: os-time-for-svc-send-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-PATH2
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS))))
         (OS-NEW-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
          (OS-NEW-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8
                 (TIMES '9

(ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
(OS-NEW-TASK-TABLE OS))
'2
(PUTNTH '0
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-DEQ (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
          '2
          (OS-DESTID OS '16)
          OS)
'211
(PUTSEG (OS-MBUFFERS OS)
'499
(PUTSEG (OS-CODE OS)
        '2547
        (PUTNTH '2558
                '3309
                (PUTNTH '3217
                        '3310
                        (TM-MEMORY OS))))))))))))))))
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
OS)
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
OS)

(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-BASE (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-LIMIT (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-lpsw (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-svc-send-handler-to-dispatcher (os),

os-time-for-svc-send-handler-to-lpsw (os))

= os-svc-send-handler-path2 (os))

Event: Disable trace-svc-send-handler-to-lpsw.

Definition: os-time-for-svc-send-handler-thru-enqueue (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-THRU-ENQUEUE
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)

(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '0
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-MBUFFERS-WITH-ENQUEUED-MESSAGE OS)
        '499
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558
                        '3309
                        (PUTNTH '2756
                                '3310
                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '2756
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-R3 OS)
'2
(PUTNTH

    (PLUS '499
          (PLUS (TIMES '8
                       (REMAINDER (GETNTH '2 (TM-REGS OS))
                                  '16))
                (TIMES '128
                       (ARRAY-QFIRST (OS-READYQ OS)))))
    '3
    (PUTNTH
      (PLUS '503
            (PLUS (PLUS (TIMES '8
                               (REMAINDER (GETNTH '2 (TM-REGS OS))
                                          '16))
                        (TIMES '128
                               (ARRAY-QFIRST (OS-READYQ OS))))
                  (GETNTH '1
                          (GETNTH (PLUS (TIMES '16
                                               (ARRAY-QFIRST (OS-READYQ OS)))
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                  (TABLE '8 (OS-MBUFFERS OS))))))
      '4
      (PUTNTH (REMAINDER (TM-R2 OS) '16)
              '6
              (PUTNTH (TM-R3 OS)
                      '7
                      (TM-REGS OS))))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (PLUS (TIMES '16
                                               (ARRAY-QFIRST (OS-READYQ OS)))
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                  (TABLE '8 (OS-MBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (PLUS (TIMES '16
                                               (ARRAY-QFIRST (OS-READYQ OS)))
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                  (TABLE '8 (OS-MBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)

(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-thru-enqueue (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                 '16),

os))))))

→ (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-thru-enqueue (os))

= os-svc-send-handler-thru-enqueue (os))

Event: Disable trace-svc-send-handler-thru-enqueue.

Definition: os-time-for-svc-send-handler-to-svc-resume-task1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-TO-SVC-RESUME-TASK1
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2

(PUTNTH '0
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (ARRAY-ENQ (OS-DESTID OS '16)
            (OS-READYQ OS))
 '191
 (PUTSEG
       (OS-UPDATE-STATUS (OS-DESTID OS '16)
                         '0
                         '0
                         OS)
       '211
       (PUTSEG (OS-MBUFFERS-WITH-ENQUEUED-MESSAGE OS)
               '499
               (PUTSEG (OS-CODE OS)
                       '2547
                       (PUTNTH '2558
                               '3309
                               (PUTNTH '2789
                                       '3310
                                       (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
'0
(PUTNTH '3310
'1
(PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                   '16)
        '2
        (PUTNTH '191

                         (PUTNTH (PLUS '195
                                       (GETNTH '1 (OS-READYQ OS)))
                                 '4
                                 (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)
                                         '6
                                         (PUTNTH (GETNTH '3 (TM-REGS OS))
                                                 '7
                                                 (TM-REGS OS))))))))
(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1 (OS-READYQ OS))
                              '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-svc-resume-task1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

        = '3)

∧ (getnth ('1 + ('2 ∗ os-destid (os, '16)), os-status-table (os))

= os-current-taskid (os)))))

→ (tm-processor (os-svc-send-handler-thru-enqueue (os),

os-time-for-svc-send-handler-to-svc-resume-task1 (os))

= os-svc-send-handler-to-svc-resume-task1 (os))

Event: Disable trace-svc-send-handler-to-svc-resume-task1.

Definition: os-time-for-svc-send-handler-to-svc-resume-task2 (os)

= '(tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-TO-SVC-RESUME-TASK2
(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '0
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-MBUFFERS-WITH-ENQUEUED-MESSAGE OS)
        '499
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558

                                        (PUTNTH '2756
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (TM-R3 OS)
   '2
   (PUTNTH
    (PLUS '211
          (TIMES '2 (OS-DESTID OS '16)))
    '3
    (PUTNTH
      (PLUS '503
            (PLUS (PLUS (TIMES '8
                               (REMAINDER (GETNTH '2 (TM-REGS OS))
                                          '16))
                        (TIMES '128
                               (ARRAY-QFIRST (OS-READYQ OS))))
                  (GETNTH '1
                          (GETNTH (PLUS (TIMES '16
                                               (ARRAY-QFIRST (OS-READYQ OS)))
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                  (TABLE '8 (OS-MBUFFERS OS))))))
      '4
      (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                         '16)
              '6
              (PUTNTH (GETNTH '3 (TM-REGS OS))
                      '7
                      (TM-REGS OS))))))))
(TM-CC-VALUE
       (TM-ALU-DIFFERENCE (GETNTH (TIMES '2
                                         (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16))
                                  (OS-STATUS-TABLE OS))
                          '3))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)

(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-svc-resume-task2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

≠ '3)))

→ (tm-processor (os-svc-send-handler-thru-enqueue (os),

os-time-for-svc-send-handler-to-svc-resume-task2 (os))

= os-svc-send-handler-to-svc-resume-task2 (os))

Event: Disable trace-svc-send-handler-to-svc-resume-task2.

Definition: os-time-for-svc-send-handler-to-svc-resume-task3 (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-TO-SVC-RESUME-TASK3
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2
   (PUTNTH '0
    '8

(PUTNTH
 (ARRAY-QFIRST (OS-READYQ OS))
 '12
 (PUTNTH
  (TM-R2 OS)
  '13
  (PUTNTH
   (TM-R3 OS)
   '14
   (PUTSEG
    (OS-NEW-TASK-TABLE OS)
    '15
    (PUTSEG
     (OS-SEGMENT-TABLE OS)
     '159
     (PUTSEG
      (OS-READYQ OS)
      '191
      (PUTSEG
            (OS-STATUS-TABLE OS)
            '211
            (PUTSEG (OS-MBUFFERS-WITH-ENQUEUED-MESSAGE OS)
                    '499
                    (PUTSEG (OS-CODE OS)
                            '2547
                            (PUTNTH '2558
                                    '3309
                                    (PUTNTH '2756
                                            '3310
                                            (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-R3 OS)
'2
(PUTNTH
(PLUS '211
      (TIMES '2 (OS-DESTID OS '16)))
'3
(PUTNTH
  (PLUS '503
        (PLUS (PLUS (TIMES '8

                               (REMAINDER (GETNTH '2 (TM-REGS OS))
                                          '16))
                        (TIMES '128
                               (ARRAY-QFIRST (OS-READYQ OS))))
                  (GETNTH '1
                          (GETNTH (PLUS (TIMES '16
                                               (ARRAY-QFIRST (OS-READYQ OS)))
                                        (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                   '16))
                                  (TABLE '8 (OS-MBUFFERS OS))))))
      '4
      (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                         '16)
              '6
              (PUTNTH (GETNTH '3 (TM-REGS OS))
                      '7
                      (TM-REGS OS))))))))
(TM-CC-VALUE
 (TM-ALU-DIFFERENCE (GETNTH (PLUS '1
                                  (TIMES '2
                                         (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)))
                            (OS-STATUS-TABLE OS))
                    (ARRAY-QFIRST (OS-READYQ OS))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-svc-resume-task3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

        = '3)

∧ (getnth ('1 + ('2 ∗ os-destid (os, '16)), os-status-table (os))

≠ os-current-taskid (os)))))

→ (tm-processor (os-svc-send-handler-thru-enqueue (os),

os-time-for-svc-send-handler-to-svc-resume-task3 (os))

= os-svc-send-handler-to-svc-resume-task3 (os))

Event: Disable trace-svc-send-handler-to-svc-resume-task3.

Definition: os-time-for-svc-send-handler-to-svcr (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-SEND-HANDLER-PATH3
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (OS-READYQ OS)))
           (OS-NEW-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (ARRAY-QFIRST (OS-READYQ OS))))
             (OS-NEW-TASK-TABLE OS))
     '2
     (PUTNTH '0
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH

       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (ARRAY-ENQ (OS-DESTID OS '16)
                     (OS-READYQ OS))
          '191
          (PUTSEG
                (OS-UPDATE-STATUS (OS-DESTID OS '16)
                                  '0
                                  '0
                                  OS)
                '211
                (PUTSEG (OS-MBUFFERS-WITH-ENQUEUED-MESSAGE OS)
                        '499
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3229
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-svcr1 (good-os (os)

∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

         = '3)

∧ (getnth ('1 + ('2 ∗ os-destid (os, '16)), os-status-table (os))

= os-current-taskid (os)))))

→ (tm-processor (os-svc-send-handler-to-svc-resume-task1 (os),

os-time-for-svc-send-handler-to-svcr (os))

= os-svc-send-handler-path3 (os))

Event: Disable trace-svc-send-handler-to-svcr1.

(DEFN
OS-SVC-SEND-HANDLER-PATH4
(OS)
(TM
 (PUTNTH
  (GETNTH (TIMES '9
                 (ARRAY-QFIRST (OS-READYQ OS)))
          (OS-NEW-TASK-TABLE OS))
  '0
  (PUTNTH
   (GETNTH (PLUS '1
                 (TIMES '9
                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '1
   (PUTNTH
    (GETNTH (PLUS '8
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '2
    (PUTNTH '0
     '8
     (PUTNTH
      (ARRAY-QFIRST (OS-READYQ OS))
      '12
      (PUTNTH
       (TM-R2 OS)
       '13
       (PUTNTH

       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (OS-READYQ OS)
          '191
          (PUTSEG
                (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-MBUFFERS-WITH-ENQUEUED-MESSAGE OS)
                        '499
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3229
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-send-handler-to-svcr2 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-svc-send-handler-to-svc-resume-task2 (os),

os-time-for-svc-send-handler-to-svcr (os))

= os-svc-send-handler-path4 (os))

Event: Disable trace-svc-send-handler-to-svcr2.

Theorem: trace-svc-send-handler-to-svcr3 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-svc-send-handler-to-svc-resume-task3 (os),

os-time-for-svc-send-handler-to-svcr (os))

= os-svc-send-handler-path4 (os))

Event: Disable trace-svc-send-handler-to-svcr3.

Definition: os-svc-send-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

Definition: os-svc-send-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

Definition: os-time-for-svc-send-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick)

Theorem: rewrite-svc-send-trace1 tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path1 (os))

= tm-processor (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-thru-save-state (os)),

os-svc-send-time1 (os))

Event: Disable rewrite-svc-send-trace1.

Theorem: rewrite-svc-send-trace2 tm-processor (os-svc-send-handler-thru-save-state (os), os-svc-send-time1 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-save-state (os),

os-time-for-svc-send-handler-to-qfullp-test (os)),

os-svc-send-time2 (os))

Event: Disable rewrite-svc-send-trace2.

Theorem: rewrite-svc-send-trace3 tm-processor (os-svc-send-handler-to-qfullp-test (os), os-svc-send-time2 (os)) = tm-processor (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-to-dispatcher (os)),

os-time-for-svc-send-handler-to-wait-state (os))

Event: Disable rewrite-svc-send-trace3.

Theorem: trace-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os))

∧ array-qemptyp (array-deq (os-readyq (os)))))))

→ (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path1 (os))

= os-svc-send-handler-path1 (os))

Event: Disable trace-svc-send-handler-path1.

Definition: os-svc-send-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Definition: os-svc-send-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Definition: os-time-for-svc-send-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

Theorem: rewrite-svc-send-trace4 tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path2 (os))

= tm-processor (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-thru-save-state (os)),

os-svc-send-time3 (os))

Event: Disable rewrite-svc-send-trace4.

Theorem: rewrite-svc-send-trace5 tm-processor (os-svc-send-handler-thru-save-state (os), os-svc-send-time3 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-save-state (os),

os-time-for-svc-send-handler-to-qfullp-test (os)),

os-svc-send-time4 (os))

Event: Disable rewrite-svc-send-trace5.

Theorem: rewrite-svc-send-trace6 tm-processor (os-svc-send-handler-to-qfullp-test (os), os-svc-send-time4 (os)) = tm-processor (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-to-dispatcher (os)),

os-time-for-svc-send-handler-to-lpsw (os))

Event: Disable rewrite-svc-send-trace6.

Theorem: trace-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0) ∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os))))))))

→ (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path2 (os))

= os-svc-send-handler-path2 (os))

Event: Disable trace-svc-send-handler-path2.

Definition: os-svc-send-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick)

Definition: os-svc-send-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick)

Definition: os-svc-send-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Definition: os-time-for-svc-send-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick

      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick)

Theorem: rewrite-svc-send-trace7 tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path3 (os))

= tm-processor (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-thru-save-state (os)),

os-svc-send-time5 (os))

Event: Disable rewrite-svc-send-trace7.

Theorem: rewrite-svc-send-trace8 tm-processor (os-svc-send-handler-thru-save-state (os), os-svc-send-time5 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-save-state (os),

os-time-for-svc-send-handler-to-qfullp-test (os)),

os-svc-send-time6 (os))

Event: Disable rewrite-svc-send-trace8.

Theorem: rewrite-svc-send-trace9 tm-processor (os-svc-send-handler-to-qfullp-test (os), os-svc-send-time6 (os)) = tm-processor (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-thru-enqueue (os)),

os-svc-send-time7 (os))

Event: Disable rewrite-svc-send-trace9.

Theorem: rewrite-svc-send-trace10 tm-processor (os-svc-send-handler-thru-enqueue (os), os-svc-send-time7 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-enqueue (os),

os-time-for-svc-send-handler-to-svc-resume-task1 (os)),

os-time-for-svc-send-handler-to-svcr (os))

Event: Disable rewrite-svc-send-trace10.

Theorem: trace-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                              '16),

os)))

∧ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

             = '3)

∧ (getnth ('1

                       + ('2

∗ os-destid (os,

                                       '16)),

os-status-table (os)) = os-current-taskid (os)))))))

→ (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path3 (os))

= os-svc-send-handler-path3 (os))

Event: Disable trace-svc-send-handler-path3.

Definition: os-svc-send-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Definition: os-svc-send-time9 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Definition: os-svc-send-time10 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick)

Definition: os-time-for-svc-send-handler-path4a (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick)

Theorem: rewrite-svc-send-trace11 tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path4a (os))

= tm-processor (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-thru-save-state (os)),

os-svc-send-time8 (os))

Event: Disable rewrite-svc-send-trace11.

Theorem: rewrite-svc-send-trace12 tm-processor (os-svc-send-handler-thru-save-state (os), os-svc-send-time8 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-save-state (os),

os-time-for-svc-send-handler-to-qfullp-test (os)),

os-svc-send-time9 (os))

Event: Disable rewrite-svc-send-trace12.

Theorem: rewrite-svc-send-trace13 tm-processor (os-svc-send-handler-to-qfullp-test (os), os-svc-send-time9 (os)) = tm-processor (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-thru-enqueue (os)),

os-svc-send-time10 (os))

Event: Disable rewrite-svc-send-trace13.

Theorem: rewrite-svc-send-trace14 tm-processor (os-svc-send-handler-thru-enqueue (os), os-svc-send-time10 (os))

= tm-processor (tm-processor (os-svc-send-handler-thru-enqueue (os),

os-time-for-svc-send-handler-to-svc-resume-task2 (os)),

os-time-for-svc-send-handler-to-svcr (os))

Event: Disable rewrite-svc-send-trace14.

Theorem: trace-svc-send-handler-path4a (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                    '16),

os)))

∧ (getnth ('2 ∗ os-destid (os, '16),

os-status-table (os)) ≠ '3)))))

→ (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path4a (os))

= os-svc-send-handler-path4 (os))

Event: Disable trace-svc-send-handler-path4a.

Definition: os-svc-send-time11 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Definition: os-svc-send-time12 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Definition: os-svc-send-time13 (os)

= '(tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-time-for-svc-send-handler-path4b (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

Theorem: rewrite-svc-send-trace15 tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path4b (os))

= tm-processor (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-thru-save-state (os)),

os-svc-send-time11 (os))

Event: Disable rewrite-svc-send-trace15.

Theorem: rewrite-svc-send-trace16 tm-processor (os-svc-send-handler-thru-save-state (os), os-svc-send-time11 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-save-state (os),

os-time-for-svc-send-handler-to-qfullp-test (os)),

os-svc-send-time12 (os))

Event: Disable rewrite-svc-send-trace16.

Theorem: rewrite-svc-send-trace17 tm-processor (os-svc-send-handler-to-qfullp-test (os), os-svc-send-time12 (os)) = tm-processor (tm-processor (os-svc-send-handler-to-qfullp-test (os),

os-time-for-svc-send-handler-thru-enqueue (os)),

os-svc-send-time13 (os))

Event: Disable rewrite-svc-send-trace17.

Theorem: rewrite-svc-send-trace18 tm-processor (os-svc-send-handler-thru-enqueue (os), os-svc-send-time13 (os)) = tm-processor (tm-processor (os-svc-send-handler-thru-enqueue (os),

os-time-for-svc-send-handler-to-svc-resume-task3 (os)),

os-time-for-svc-send-handler-to-svcr (os))

Event: Disable rewrite-svc-send-trace18.

Theorem: trace-svc-send-handler-path4b (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                    '16),

os)))

∧ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

                   = '3)

∧ (getnth ('1

                            + ('2

∗ os-destid (os,

                                            '16)),

os-status-table (os)) ≠ os-current-taskid (os)))))))

→ (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path4b (os))

= os-svc-send-handler-path4 (os))

Event: Disable trace-svc-send-handler-path4b.

Definition: os-time-for-svc-send-handler-path4 (os) = if getnth ('2 ∗ os-destid (os, '16), os-status-table (os)) ≠ '3

then os-time-for-svc-send-handler-path4a (os) else os-time-for-svc-send-handler-path4b (os) endif

Theorem: trace-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                    '16),

os)))

∧ (¬ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

                     = '3)

∧ (getnth ('1

                               + ('2

∗ os-destid (os,

                                               '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler-path4 (os))

= os-svc-send-handler-path4 (os))

Event: Disable trace-svc-send-handler-path4.

Definition: os-time-for-svc-send-handler (os) = if array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os, '16), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-time-for-svc-send-handler-path1 (os) else os-time-for-svc-send-handler-path2 (os) endif elseif (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

          = '3)

∧ (getnth ('1 + ('2 ∗ os-destid (os, '16)), os-status-table (os))

= os-current-taskid (os)) then os-time-for-svc-send-handler-path3 (os) else os-time-for-svc-send-handler-path4 (os) endif

Definition: os-svc-send-handler (os) = if array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os, '16), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-svc-send-handler-path1 (os) else os-svc-send-handler-path2 (os) endif

elseif (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

          = '3)

∧ (getnth ('1 + ('2 ∗ os-destid (os, '16)), os-status-table (os))

= os-current-taskid (os)) then os-svc-send-handler-path3 (os) else os-svc-send-handler-path4 (os) endif

Theorem: trace-svc-send-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '0))) → (tm-processor (os-intended-svc-send-interrupt (os),

os-time-for-svc-send-handler (os))

= os-svc-send-handler (os))

Event: Disable trace-svc-send-handler.

Definition: os-intended-svc-receive-interrupt (tm) = os-intended-svc-send-interrupt (tm)

Theorem: equivalence-of-svc-receive-interrupt-expressions (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-execute-svc-interrupt (os)

= os-intended-svc-receive-interrupt (os))

Event: Disable equivalence-of-svc-receive-interrupt-expressions.

Definition: os-time-for-svc-receive-handler-thru-save-state (os) = os-time-for-svc-send-handler-thru-save-state (os)

Definition: os-svc-receive-handler-thru-save-state (os) = os-svc-send-handler-thru-save-state (os)

Theorem: trace-svc-receive-handler-thru-save-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-thru-save-state (os))

= os-svc-receive-handler-thru-save-state (os))

Event: Disable trace-svc-receive-handler-thru-save-state.

Definition: os-time-for-svc-receive-handler-to-qemptyp-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

(DEFN OS-SVC-RECEIVE-HANDLER-TO-QEMPTYP-TEST
(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-MBUFFERS OS)
        '499
        (PUTSEG (OS-CODE OS)
                '2547

                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '2824
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '2845
    '0
    (PUTNTH '3310
            '1
            (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                    '2
                    (PUTNTH (PLUS '499
                                  (PLUS (TIMES '8
                                               (ARRAY-QFIRST (OS-READYQ OS)))
                                        (TIMES '128
                                               (REMAINDER (TM-R2 OS) '16))))
                            '3
                            (PUTNTH (TIMES '8
                                           (ARRAY-QFIRST (OS-READYQ OS)))
                                    '4
                                    (PUTNTH (REMAINDER (TM-R2 OS) '16)
                                            '6
                                            (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS (TIMES '8
                                       (ARRAY-QFIRST (OS-READYQ OS)))
                                (TIMES '128
                                       (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                  '16)))
                          '499))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-qemptyp-test (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '1)))

→ (tm-processor (os-svc-receive-handler-thru-save-state (os),

os-time-for-svc-receive-handler-to-qemptyp-test (os))

= os-svc-receive-handler-to-qemptyp-test (os))

Event: Disable trace-svc-receive-handler-to-qemptyp-test.

Definition: os-time-for-svc-receive-handler-to-dispatcher (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-TO-DISPATCHER
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '1
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-NEW-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)

         (PUTSEG
          (ARRAY-DEQ (OS-READYQ OS))
          '191
          (PUTSEG
                (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                  '3
                                  (OS-SRCID OS '16)
                                  OS)
                '211
                (PUTSEG (OS-MBUFFERS OS)
                        '499
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '2905
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
         '1
         (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                 '2
                 (PUTNTH (PLUS '211
                               (TIMES '2
                                      (ARRAY-QFIRST (OS-READYQ OS))))
                         '3
                         (PUTNTH (TIMES '8
                                        (ARRAY-QFIRST (OS-READYQ OS)))
                                 '4
                                 (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)
                                         '6
                                         (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '2
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '211))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)

(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-dispatcher (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)))))

→ (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-to-dispatcher (os))

= os-svc-receive-handler-to-dispatcher (os))

Event: Disable trace-svc-receive-handler-to-dispatcher.

Definition: os-time-for-svc-receive-handler-to-wait-state (os)

= '(tick tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-PATH1
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2
   (PUTNTH '1
    '8

(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (ARRAY-DEQ (OS-READYQ OS))
 '191
 (PUTSEG
       (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                         '3
                         (OS-SRCID OS '16)
                         OS)
       '211
       (PUTSEG (OS-MBUFFERS OS)
               '499
               (PUTSEG (OS-CODE OS)
                       '2547
                       (PUTNTH '2558
                               '3309
                               (PUTNTH '3211
                                       '3310
                                       (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
'0
(PUTNTH '3310
'1
(PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
        '2
        (PUTNTH '191
                '3
                (PUTNTH (TIMES '8
                               (ARRAY-QFIRST (OS-READYQ OS)))
                        '4

                                 (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)
                                         '6
                                         (TM-REGS OS)))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-wait-state (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (tm-processor (os-svc-receive-handler-to-dispatcher (os),

os-time-for-svc-receive-handler-to-wait-state (os))

= os-svc-receive-handler-path1 (os))

Event: Disable trace-svc-receive-handler-to-wait-state.

Definition: os-time-for-svc-receive-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-PATH2
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS))))
         (OS-NEW-TASK-TABLE OS))
 '0

(PUTNTH
(GETNTH (PLUS '1
(TIMES '9
       (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
(OS-NEW-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
 (TIMES '9
        (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
(OS-NEW-TASK-TABLE OS))
'2
(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-DEQ (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                  '3
                  (OS-SRCID OS '16)
                  OS)
'211
(PUTSEG (OS-MBUFFERS OS)
        '499
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558
                        '3309

                                        (PUTNTH '3217
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-BASE (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-LIMIT (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-lpsw (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-svc-receive-handler-to-dispatcher (os),

os-time-for-svc-receive-handler-to-lpsw (os))

= os-svc-receive-handler-path2 (os))

Event: Disable trace-svc-receive-handler-to-lpsw.

Definition: os-time-for-svc-receive-handler-thru-delivery (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-THRU-DELIVERY
(OS)

(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-MBUFFERS-WITH-DEQUEUED-MESSAGE OS)
        '499
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558
                        '3309
                        (PUTNTH '2853
                                '3310

                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '2865
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
      (ARRAY-QFIRST (GETNTH (PLUS (ARRAY-QFIRST (OS-READYQ OS))
                                  (TIMES '16
                                         (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)))
                            (TABLE '8 (OS-MBUFFERS OS))))
      '2
      (PUTNTH (PLUS '15
                    (TIMES '9
                           (ARRAY-QFIRST (OS-READYQ OS))))
              '3
              (PUTNTH (TIMES '8
                             (ARRAY-QFIRST (OS-READYQ OS)))
                      '4
                      (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                         '16)
                              '6
                              (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '9
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '15))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-thru-delivery (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1) ∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, os-current-taskid (os), os))))))

→ (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-thru-delivery (os))

= os-svc-receive-handler-thru-delivery (os))

Event: Disable trace-svc-receive-handler-thru-delivery.

Definition: os-time-for-svc-receive-handler-to-svc-resume-task1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-TO-SVC-RESUME-TASK1
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '1
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS)

(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (ARRAY-ENQ (OS-SRCID OS '16)
            (OS-READYQ OS))
 '191
 (PUTSEG
       (OS-UPDATE-STATUS (OS-SRCID OS '16)
                         '0
                         '0
                         OS)
       '211
       (PUTSEG (OS-MBUFFERS-WITH-DEQUEUED-MESSAGE OS)
               '499
               (PUTSEG (OS-CODE OS)
                       '2547
                       (PUTNTH '2558
                               '3309
                               (PUTNTH '2898
                                       '3310
                                       (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
'0
(PUTNTH '3310
'1
(PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                   '16)
        '2
        (PUTNTH '191
                '3
                (PUTNTH (PLUS '195
                              (GETNTH '1 (OS-READYQ OS)))
                        '4
                        (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                           '16)
                                '6
                                (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1 (OS-READYQ OS))
                     '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)

(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-svc-resume-task1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

        = '2)

∧ (getnth ('1 + ('2 ∗ os-srcid (os, '16)), os-status-table (os))

= os-current-taskid (os)))))

→ (tm-processor (os-svc-receive-handler-thru-delivery (os),

os-time-for-svc-receive-handler-to-svc-resume-task1 (os))

= os-svc-receive-handler-to-svc-resume-task1 (os))

Event: Disable trace-svc-receive-handler-to-svc-resume-task1.

Definition: os-time-for-svc-receive-handler-to-svc-resume-task2 (os)

= '(tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-TO-SVC-RESUME-TASK2
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))

(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
 (TM-R3 OS)
 '14
 (PUTSEG
  (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS)
  '15
  (PUTSEG
   (OS-SEGMENT-TABLE OS)
   '159
   (PUTSEG
    (OS-READYQ OS)
    '191
    (PUTSEG
          (OS-STATUS-TABLE OS)
          '211
          (PUTSEG (OS-MBUFFERS-WITH-DEQUEUED-MESSAGE OS)
                  '499
                  (PUTSEG (OS-CODE OS)
                          '2547
                          (PUTNTH '2558
                                  '3309
                                  (PUTNTH '2853
                                          '3310
                                          (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
'0
(PUTNTH '3310
'1
(PUTNTH
(ARRAY-QFIRST (GETNTH (PLUS (ARRAY-QFIRST (OS-READYQ OS))
                            (TIMES '16
                                   (REMAINDER (GETNTH '2 (TM-REGS OS))
                                              '16)))
                      (TABLE '8 (OS-MBUFFERS OS))))
'2

      (PUTNTH (PLUS '211
                    (TIMES '2
                           (REMAINDER (GETNTH '2 (TM-REGS OS))
                                      '16)))
              '3
              (PUTNTH (TIMES '8
                             (ARRAY-QFIRST (OS-READYQ OS)))
                      '4
                      (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                         '16)
                              '6
                              (TM-REGS OS)))))))
(TM-CC-VALUE
       (TM-ALU-DIFFERENCE (GETNTH (TIMES '2
                                         (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16))
                                  (OS-STATUS-TABLE OS))
                          '2))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-svc-resume-task2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

≠ '2)))

→ (tm-processor (os-svc-receive-handler-thru-delivery (os),

os-time-for-svc-receive-handler-to-svc-resume-task2 (os))

= os-svc-receive-handler-to-svc-resume-task2 (os))

Event: Disable trace-svc-receive-handler-to-svc-resume-task2.

Definition: os-time-for-svc-receive-handler-to-svc-resume-task3 (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-TO-SVC-RESUME-TASK3
(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-MBUFFERS-WITH-DEQUEUED-MESSAGE OS)
        '499

                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '2853
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
      (ARRAY-QFIRST (GETNTH (PLUS (ARRAY-QFIRST (OS-READYQ OS))
                                  (TIMES '16
                                         (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)))
                            (TABLE '8 (OS-MBUFFERS OS))))
      '2
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (REMAINDER (GETNTH '2 (TM-REGS OS))
                                      '16)))
              '3
              (PUTNTH (TIMES '8
                             (ARRAY-QFIRST (OS-READYQ OS)))
                      '4
                      (PUTNTH (REMAINDER (GETNTH '2 (TM-REGS OS))
                                         '16)
                              '6
                              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-DIFFERENCE (GETNTH (PLUS '1
                                  (TIMES '2
                                         (REMAINDER (GETNTH '2 (TM-REGS OS))
                                                    '16)))
                            (OS-STATUS-TABLE OS))
                    (ARRAY-QFIRST (OS-READYQ OS))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1

  (TM-CLOCK OS)
  (TM-IPORTS OS)
  (TM-OPORTS OS))
 NIL)

Theorem: trace-svc-receive-handler-to-svc-resume-task3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

          = '2)

∧ (getnth ('1 + ('2 ∗ os-srcid (os, '16)), os-status-table (os))

≠ os-current-taskid (os)))))

→ (tm-processor (os-svc-receive-handler-thru-delivery (os),

os-time-for-svc-receive-handler-to-svc-resume-task3 (os))

= os-svc-receive-handler-to-svc-resume-task3 (os))

Event: Disable trace-svc-receive-handler-to-svc-resume-task3.

Definition: os-time-for-svc-receive-handler-to-svcr (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-RECEIVE-HANDLER-PATH3
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (OS-READYQ OS)))
           (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8

         (TIMES '9
                (ARRAY-QFIRST (OS-READYQ OS))))
   (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS))
'2
(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS)
'15
(PUTSEG
 (OS-SEGMENT-TABLE OS)
 '159
 (PUTSEG
  (ARRAY-ENQ (OS-SRCID OS '16)
             (OS-READYQ OS))
  '191
  (PUTSEG
        (OS-UPDATE-STATUS (OS-SRCID OS '16)
                          '0
                          '0
                          OS)
        '211
        (PUTSEG (OS-MBUFFERS-WITH-DEQUEUED-MESSAGE OS)
                '499
                (PUTSEG (OS-CODE OS)
                        '2547
                        (PUTNTH '2558
                                '3309
                                (PUTNTH '3229
                                        '3310
                                        (TM-MEMORY OS))))))))))))))))
(PUTNTH (ARRAY-QFIRST (OS-CURRENT-MBUFFER (OS-SRCID OS '16)
                                  (OS-CURRENT-TASKID OS)
                                  OS))
'3

        (TM-REGS OS))
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-svcr1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

        = '2)

∧ (getnth ('1 + ('2 ∗ os-srcid (os, '16)), os-status-table (os))

= os-current-taskid (os)))))

→ (tm-processor (os-svc-receive-handler-to-svc-resume-task1 (os),

os-time-for-svc-receive-handler-to-svcr (os))

= os-svc-receive-handler-path3 (os))

Event: Disable trace-svc-receive-handler-to-svcr1.

(DEFN
OS-SVC-RECEIVE-HANDLER-PATH4
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (OS-READYQ OS)))
         (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (OS-READYQ OS))))

(OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
       (TIMES '9
              (ARRAY-QFIRST (OS-READYQ OS))))
 (OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS))
'2
(PUTNTH '1
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE-WITH-DELIVERED-MESSAGE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
      (OS-STATUS-TABLE OS)
      '211
      (PUTSEG (OS-MBUFFERS-WITH-DEQUEUED-MESSAGE OS)
              '499
              (PUTSEG (OS-CODE OS)
                      '2547
                      (PUTNTH '2558
                              '3309
                              (PUTNTH '3229
                                      '3310
                                      (TM-MEMORY OS))))))))))))))))
(PUTNTH (ARRAY-QFIRST (OS-CURRENT-MBUFFER (OS-SRCID OS '16)
                                (OS-CURRENT-TASKID OS)
                                OS))
'3

        (TM-REGS OS))
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-receive-handler-to-svcr2 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-svc-receive-handler-to-svc-resume-task2 (os),

os-time-for-svc-receive-handler-to-svcr (os))

= os-svc-receive-handler-path4 (os))

Event: Disable trace-svc-receive-handler-to-svcr2.

Theorem: trace-svc-receive-handler-to-svcr3 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-svc-receive-handler-to-svc-resume-task3 (os),

os-time-for-svc-receive-handler-to-svcr (os))

= os-svc-receive-handler-path4 (os))

Event: Disable trace-svc-receive-handler-to-svcr3.

Definition: os-svc-receive-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick)

Definition: os-svc-receive-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick)

Definition: os-time-for-svc-receive-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Theorem: rewrite-svc-receive-trace1 tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path1 (os))

= tm-processor (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-thru-save-state (os)),

os-svc-receive-time1 (os))

Event: Disable rewrite-svc-receive-trace1.

Theorem: rewrite-svc-receive-trace2 tm-processor (os-svc-receive-handler-thru-save-state (os),

os-svc-receive-time1 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-save-state (os),

os-time-for-svc-receive-handler-to-qemptyp-test (os)),

os-svc-receive-time2 (os))

Event: Disable rewrite-svc-receive-trace2.

Theorem: rewrite-svc-receive-trace3 tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-svc-receive-time2 (os))

= tm-processor (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-to-dispatcher (os)),

os-time-for-svc-receive-handler-to-wait-state (os))

Event: Disable rewrite-svc-receive-trace3.

Theorem: trace-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os)))))))

→ (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path1 (os))

= os-svc-receive-handler-path1 (os))

Event: Disable trace-svc-receive-handler-path1.

Definition: os-svc-receive-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick)

Definition: os-svc-receive-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Definition: os-time-for-svc-receive-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Theorem: rewrite-svc-receive-trace4 tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path2 (os))

= tm-processor (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-thru-save-state (os)),

os-svc-receive-time3 (os))

Event: Disable rewrite-svc-receive-trace4.

Theorem: rewrite-svc-receive-trace5 tm-processor (os-svc-receive-handler-thru-save-state (os),

os-svc-receive-time3 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-save-state (os),

os-time-for-svc-receive-handler-to-qemptyp-test (os)),

os-svc-receive-time4 (os))

Event: Disable rewrite-svc-receive-trace5.

Theorem: rewrite-svc-receive-trace6 tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-svc-receive-time4 (os))

= tm-processor (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-to-dispatcher (os)),

os-time-for-svc-receive-handler-to-lpsw (os))

Event: Disable rewrite-svc-receive-trace6.

Theorem: trace-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os))))))))

→ (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path2 (os))

= os-svc-receive-handler-path2 (os))

Event: Disable trace-svc-receive-handler-path2.

Definition: os-svc-receive-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-svc-receive-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Definition: os-svc-receive-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Definition: os-time-for-svc-receive-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Theorem: rewrite-svc-receive-trace7 tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path3 (os))

= tm-processor (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-thru-save-state (os)),

os-svc-receive-time5 (os))

Event: Disable rewrite-svc-receive-trace7.

Theorem: rewrite-svc-receive-trace8 tm-processor (os-svc-receive-handler-thru-save-state (os),

os-svc-receive-time5 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-save-state (os),

os-time-for-svc-receive-handler-to-qemptyp-test (os)),

os-svc-receive-time6 (os))

Event: Disable rewrite-svc-receive-trace8.

Theorem: rewrite-svc-receive-trace9 tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-svc-receive-time6 (os))

= tm-processor (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-thru-delivery (os)),

os-svc-receive-time7 (os))

Event: Disable rewrite-svc-receive-trace9.

Theorem: rewrite-svc-receive-trace10 tm-processor (os-svc-receive-handler-thru-delivery (os),

os-svc-receive-time7 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-delivery (os),

os-time-for-svc-receive-handler-to-svc-resume-task1 (os)),

os-time-for-svc-receive-handler-to-svcr (os))

Event: Disable rewrite-svc-receive-trace10.

Theorem: trace-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                     '16),

os-current-taskid (os), os)))

∧ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                   = '2)

∧ (getnth ('1

                            + ('2

∗ os-srcid (os,

                                           '16)),

os-status-table (os))

= os-current-taskid (os)))))))

→ (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path3 (os))

= os-svc-receive-handler-path3 (os))

Event: Disable trace-svc-receive-handler-path3.

Definition: os-svc-receive-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Definition: os-svc-receive-time9 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick)

Definition: os-svc-receive-time10 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

Definition: os-time-for-svc-receive-handler-path4a (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick

      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Theorem: rewrite-svc-receive-trace11 tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path4a (os))

= tm-processor (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-thru-save-state (os)),

os-svc-receive-time8 (os))

Event: Disable rewrite-svc-receive-trace11.

Theorem: rewrite-svc-receive-trace12 tm-processor (os-svc-receive-handler-thru-save-state (os),

os-svc-receive-time8 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-save-state (os),

os-time-for-svc-receive-handler-to-qemptyp-test (os)),

os-svc-receive-time9 (os))

Event: Disable rewrite-svc-receive-trace12.

Theorem: rewrite-svc-receive-trace13 tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-svc-receive-time9 (os))

= tm-processor (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-thru-delivery (os)),

os-svc-receive-time10 (os))

Event: Disable rewrite-svc-receive-trace13.

Theorem: rewrite-svc-receive-trace14 tm-processor (os-svc-receive-handler-thru-delivery (os),

os-svc-receive-time10 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-delivery (os),

os-time-for-svc-receive-handler-to-svc-resume-task2 (os)),

os-time-for-svc-receive-handler-to-svcr (os))

Event: Disable rewrite-svc-receive-trace14.

Theorem: trace-svc-receive-handler-path4a (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                '16),

os-current-taskid (os), os)))

∧ (getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os)) ≠ '2)))))

→ (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path4a (os))

= os-svc-receive-handler-path4 (os))

Event: Disable trace-svc-receive-handler-path4a.

Definition: os-svc-receive-time11 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Definition: os-svc-receive-time12 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

Definition: os-svc-receive-time13 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-time-for-svc-receive-handler-path4b (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick)

Theorem: rewrite-svc-receive-trace15 tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path4b (os))

= tm-processor (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-thru-save-state (os)),

os-svc-receive-time11 (os))

Event: Disable rewrite-svc-receive-trace15.

Theorem: rewrite-svc-receive-trace16 tm-processor (os-svc-receive-handler-thru-save-state (os),

os-svc-receive-time11 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-save-state (os),

os-time-for-svc-receive-handler-to-qemptyp-test (os)),

os-svc-receive-time12 (os))

Event: Disable rewrite-svc-receive-trace16.

Theorem: rewrite-svc-receive-trace17 tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-svc-receive-time12 (os))

= tm-processor (tm-processor (os-svc-receive-handler-to-qemptyp-test (os),

os-time-for-svc-receive-handler-thru-delivery (os)),

os-svc-receive-time13 (os))

Event: Disable rewrite-svc-receive-trace17.

Theorem: rewrite-svc-receive-trace18 tm-processor (os-svc-receive-handler-thru-delivery (os),

os-svc-receive-time13 (os))

= tm-processor (tm-processor (os-svc-receive-handler-thru-delivery (os),

os-time-for-svc-receive-handler-to-svc-resume-task3 (os)),

os-time-for-svc-receive-handler-to-svcr (os))

Event: Disable rewrite-svc-receive-trace18.

Theorem: trace-svc-receive-handler-path4b (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                     '16),

os-current-taskid (os), os)))

∧ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                   = '2)

∧ (getnth ('1

                            + ('2

∗ os-srcid (os,

                                           '16)),

os-status-table (os)) ≠ os-current-taskid (os)))))))

→ (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path4b (os))

= os-svc-receive-handler-path4 (os))

Event: Disable trace-svc-receive-handler-path4b.

Definition: os-time-for-svc-receive-handler-path4 (os) = if getnth ('2 ∗ os-srcid (os, '16), os-status-table (os)) ≠ '2

then os-time-for-svc-receive-handler-path4a (os) else os-time-for-svc-receive-handler-path4b (os) endif

Theorem: trace-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                     '16),

os-current-taskid (os), os)))

∧ (¬ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                     = '2)

∧ (getnth ('1

                               + ('2

∗ os-srcid (os,

                                              '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler-path4 (os))

= os-svc-receive-handler-path4 (os))

Event: Disable trace-svc-receive-handler-path4.

Definition: os-time-for-svc-receive-handler (os) = if array-qemptyp (os-current-mbuffer (os-srcid (os, '16),

os-current-taskid (os), os))

then if array-qemptyp (array-deq (os-readyq (os)))

then os-time-for-svc-receive-handler-path1 (os) else os-time-for-svc-receive-handler-path2 (os) endif elseif (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os)) = '2)

∧ (getnth ('1 + ('2 ∗ os-srcid (os, '16)), os-status-table (os))

= os-current-taskid (os)) then os-time-for-svc-receive-handler-path3 (os) else os-time-for-svc-receive-handler-path4 (os) endif

Definition: os-svc-receive-handler (os) = if array-qemptyp (os-current-mbuffer (os-srcid (os, '16),

os-current-taskid (os), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-svc-receive-handler-path1 (os) else os-svc-receive-handler-path2 (os) endif

elseif (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os)) = '2)

∧ (getnth ('1 + ('2 ∗ os-srcid (os, '16)), os-status-table (os))

= os-current-taskid (os))

then os-svc-receive-handler-path3 (os) else os-svc-receive-handler-path4 (os) endif

Theorem: trace-svc-receive-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '1))) → (tm-processor (os-intended-svc-receive-interrupt (os),

os-time-for-svc-receive-handler (os))

= os-svc-receive-handler (os))

Event: Disable trace-svc-receive-handler.

Definition: os-intended-svc-tyi-interrupt (tm) = tm-set-memory (putnth (tm-pc (tm),

                        '0,

putnth (tm-sp (tm),

                               '1,

putnth (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                                     '2,

putnth (tm-svcid (tm),

                                            '8,

putseg (os-task-table (tm),

                                                   '15,

putseg (os-segment-table (tm),

                                                         '159,

putseg (os-readyq (tm),

                                                                '191,

putseg (os-status-table (tm),

                                                                      '211,

putseg (os-ibuffers (tm),

                                                                             '243,

putseg (os-code (tm),

                                                                                   '2547,

tm-memory (tm))))))))))),

tm-set-pc ('2690,

tm-set-sp ('3310,

tm-set-svmode ('1,

tm-set-error ('0,

tm-set-rwstate ('0, tm))))))

Theorem: equivalence-of-svc-tyi-interrupt-expressions (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-execute-svc-interrupt (os) = os-intended-svc-tyi-interrupt (os))

Event: Disable equivalence-of-svc-tyi-interrupt-expressions.

Definition: os-time-for-svc-tyi-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-THRU-SAVE-STATE
(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
 (TM-R1 OS)
 '1
 (PUTNTH
  (TM-PACK-PSW (TM-CC OS)
               (TM-ERROR OS)
               (TM-SVCFLAG OS)
               (TM-SVCID OS))
  '2
  (PUTNTH
   (TM-SVCID OS)
   '8
   (PUTNTH
    (TM-R2 OS)
    '13
    (PUTNTH
     (TM-R3 OS)
     '14
     (PUTSEG
      (OS-NEW-TASK-TABLE OS)
      '15
      (PUTSEG
       (OS-SEGMENT-TABLE OS)
       '159
       (PUTSEG
        (OS-READYQ OS)
        '191
        (PUTSEG (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-IBUFFERS OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '2692

                                                 (TM-MEMORY OS)))))))))))))))
(PUTNTH '2692
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (TM-R2 OS)
                        '2
                        (PUTNTH (TM-R3 OS)
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15
                                (TIMES '9
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '8))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-thru-save-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-thru-save-state (os))

= os-svc-tyi-handler-thru-save-state (os))

Event: Disable trace-svc-tyi-handler-thru-save-state.

Definition: os-time-for-svc-tyi-handler-to-qemptyp-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-TO-QEMPTYP-TEST

(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '3
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-IBUFFERS OS)
        '243
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558
                        '3309
                        (PUTNTH '2986

                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '2998
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                        '2
                        (PUTNTH (PLUS '243
                                      (TIMES '8
                                             (ARRAY-QFIRST (OS-READYQ OS))))
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '8
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '243))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-to-qemptyp-test (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '3))) → (tm-processor (os-svc-tyi-handler-thru-save-state (os),

os-time-for-svc-tyi-handler-to-qemptyp-test (os))

= os-svc-tyi-handler-to-qemptyp-test (os))

Event: Disable trace-svc-tyi-handler-to-qemptyp-test.

Definition: os-time-for-svc-tyi-handler-to-dispatcher (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-TO-DISPATCHER
(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '3
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-DEQ (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                  '5
                  '0
                  OS)
'211
(PUTSEG (OS-IBUFFERS OS)
        '243
        (PUTSEG (OS-CODE OS)

                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3025
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3206
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                        '2
                        (PUTNTH (PLUS '211
                                      (TIMES '2
                                             (ARRAY-QFIRST (OS-READYQ OS))))
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '2
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '211))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-to-dispatcher (good-os (os) ∧ ((¬ tm-waiting (os))

∧ array-qemptyp (os-current-ibuffer (os-current-taskid (os), os)))) → (tm-processor (os-svc-tyi-handler-to-qemptyp-test (os),

os-time-for-svc-tyi-handler-to-dispatcher (os))

= os-svc-tyi-handler-to-dispatcher (os))

Event: Disable trace-svc-tyi-handler-to-dispatcher.

Definition: os-time-for-svc-tyi-handler-to-wait-state (os)

= '(tick tick tick tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-PATH1
(OS)
(TM
(PUTNTH
(TM-R0 OS)
'0
(PUTNTH
(TM-R1 OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH '3
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-DEQ (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                  '5
                  '0

                                  OS)
                '211
                (PUTSEG (OS-IBUFFERS OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3211
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                        '2
                        (PUTNTH '191 '3 (TM-REGS OS)))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-to-wait-state (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (tm-processor (os-svc-tyi-handler-to-dispatcher (os),

os-time-for-svc-tyi-handler-to-wait-state (os))

= os-svc-tyi-handler-path1 (os))

Event: Disable trace-svc-tyi-handler-to-wait-state.

Definition: os-time-for-svc-tyi-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-PATH2
(OS)
(TM
(PUTNTH
(GETNTH (TIMES '9
       (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS))))
(OS-NEW-TASK-TABLE OS))
'0
(PUTNTH
(GETNTH (PLUS '1
       (TIMES '9
              (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
 (OS-NEW-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
        (TIMES '9
               (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
  (OS-NEW-TASK-TABLE OS))
'2
(PUTNTH '3
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG

          (ARRAY-DEQ (OS-READYQ OS))
          '191
          (PUTSEG
                (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                  '5
                                  '0
                                  OS)
                '211
                (PUTSEG (OS-IBUFFERS OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3217
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-BASE (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-LIMIT (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-to-lpsw (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-svc-tyi-handler-to-dispatcher (os),

os-time-for-svc-tyi-handler-to-lpsw (os))

= os-svc-tyi-handler-path2 (os))

Event: Disable trace-svc-tyi-handler-to-lpsw.

Definition: os-time-for-svc-tyi-handler-thru-delivery (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-THRU-DELIVERY
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '3
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-TASK-TABLE-WITH-DELIVERED-CHARACTER OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159

         (PUTSEG
          (OS-READYQ OS)
          '191
          (PUTSEG
                (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-IBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3006
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (GETNTH (ARRAY-QFIRST (OS-READYQ OS))
                                              (TABLE '8 (OS-IBUFFERS OS))))
                        '2
                        (PUTNTH (PLUS '15
                                      (TIMES '9
                                             (ARRAY-QFIRST (OS-READYQ OS))))
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '9
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '15))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-thru-delivery (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))

→ (tm-processor (os-svc-tyi-handler-to-qemptyp-test (os),

os-time-for-svc-tyi-handler-thru-delivery (os))

= os-svc-tyi-handler-thru-delivery (os))

Event: Disable trace-svc-tyi-handler-thru-delivery.

Definition: os-time-for-svc-tyi-handler-to-svcr (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-TYI-HANDLER-PATH3
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (OS-READYQ OS)))
           (OS-TASK-TABLE-WITH-DELIVERED-CHARACTER OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-TASK-TABLE-WITH-DELIVERED-CHARACTER OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (ARRAY-QFIRST (OS-READYQ OS))))
             (OS-TASK-TABLE-WITH-DELIVERED-CHARACTER OS))
     '2
     (PUTNTH '3
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH

      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-TASK-TABLE-WITH-DELIVERED-CHARACTER OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (OS-READYQ OS)
          '191
          (PUTSEG
                (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-IBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3229
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH (ARRAY-QFIRST (GETNTH (OS-CURRENT-TASKID OS)
                              (TABLE '8 (OS-IBUFFERS OS))))
        '3
        (TM-REGS OS))
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyi-handler-to-svcr (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-svc-tyi-handler-thru-delivery (os),

os-time-for-svc-tyi-handler-to-svcr (os))

= os-svc-tyi-handler-path3 (os))

Event: Disable trace-svc-tyi-handler-to-svcr.

Definition: os-svc-tyi-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick)

Definition: os-svc-tyi-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

Definition: os-time-for-svc-tyi-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

Theorem: rewrite-svc-tyi-trace1 tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-path1 (os))

= tm-processor (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-thru-save-state (os)),

os-svc-tyi-time1 (os))

Event: Disable rewrite-svc-tyi-trace1.

Theorem: rewrite-svc-tyi-trace2 tm-processor (os-svc-tyi-handler-thru-save-state (os), os-svc-tyi-time1 (os)) = tm-processor (tm-processor (os-svc-tyi-handler-thru-save-state (os),

os-time-for-svc-tyi-handler-to-qemptyp-test (os)),

os-svc-tyi-time2 (os))

Event: Disable rewrite-svc-tyi-trace2.

Theorem: rewrite-svc-tyi-trace3 tm-processor (os-svc-tyi-handler-to-qemptyp-test (os), os-svc-tyi-time2 (os)) = tm-processor (tm-processor (os-svc-tyi-handler-to-qemptyp-test (os),

os-time-for-svc-tyi-handler-to-dispatcher (os)),

os-time-for-svc-tyi-handler-to-wait-state (os))

Event: Disable rewrite-svc-tyi-trace3.

Theorem: trace-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os)))))))

→ (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-path1 (os))

= os-svc-tyi-handler-path1 (os))

Event: Disable trace-svc-tyi-handler-path1.

Definition: os-svc-tyi-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Definition: os-svc-tyi-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Definition: os-time-for-svc-tyi-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Theorem: rewrite-svc-tyi-trace4 tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-path2 (os))

= tm-processor (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-thru-save-state (os)),

os-svc-tyi-time3 (os))

Event: Disable rewrite-svc-tyi-trace4.

Theorem: rewrite-svc-tyi-trace5 tm-processor (os-svc-tyi-handler-thru-save-state (os), os-svc-tyi-time3 (os)) = tm-processor (tm-processor (os-svc-tyi-handler-thru-save-state (os),

os-time-for-svc-tyi-handler-to-qemptyp-test (os)),

os-svc-tyi-time4 (os))

Event: Disable rewrite-svc-tyi-trace5.

Theorem: rewrite-svc-tyi-trace6 tm-processor (os-svc-tyi-handler-to-qemptyp-test (os), os-svc-tyi-time4 (os)) = tm-processor (tm-processor (os-svc-tyi-handler-to-qemptyp-test (os),

os-time-for-svc-tyi-handler-to-dispatcher (os)),

os-time-for-svc-tyi-handler-to-lpsw (os))

Event: Disable rewrite-svc-tyi-trace6.

Theorem: trace-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os))))))))

→ (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-path2 (os))

= os-svc-tyi-handler-path2 (os))

Event: Disable trace-svc-tyi-handler-path2.

Definition: os-svc-tyi-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Definition: os-svc-tyi-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-time-for-svc-tyi-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick)

Theorem: rewrite-svc-tyi-trace7 tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-path3 (os))

= tm-processor (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-thru-save-state (os)),

os-svc-tyi-time5 (os))

Event: Disable rewrite-svc-tyi-trace7.

Theorem: rewrite-svc-tyi-trace8 tm-processor (os-svc-tyi-handler-thru-save-state (os), os-svc-tyi-time5 (os)) = tm-processor (tm-processor (os-svc-tyi-handler-thru-save-state (os),

os-time-for-svc-tyi-handler-to-qemptyp-test (os)),

os-svc-tyi-time6 (os))

Event: Disable rewrite-svc-tyi-trace8.

Theorem: rewrite-svc-tyi-trace9 tm-processor (os-svc-tyi-handler-to-qemptyp-test (os), os-svc-tyi-time6 (os)) = tm-processor (tm-processor (os-svc-tyi-handler-to-qemptyp-test (os),

os-time-for-svc-tyi-handler-thru-delivery (os)),

os-time-for-svc-tyi-handler-to-svcr (os))

Event: Disable rewrite-svc-tyi-trace9.

Theorem: trace-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))))))

→ (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler-path3 (os))

= os-svc-tyi-handler-path3 (os))

Event: Disable trace-svc-tyi-handler-path3.

Definition: os-time-for-svc-tyi-handler (os) = if array-qemptyp (os-current-ibuffer (os-current-taskid (os), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-time-for-svc-tyi-handler-path1 (os) else os-time-for-svc-tyi-handler-path2 (os) endif

else os-time-for-svc-tyi-handler-path3 (os) endif

Definition: os-svc-tyi-handler (os) = if array-qemptyp (os-current-ibuffer (os-current-taskid (os), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-svc-tyi-handler-path1 (os) else os-svc-tyi-handler-path2 (os) endif

else os-svc-tyi-handler-path3 (os) endif Theorem: trace-svc-tyi-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '3))) → (tm-processor (os-intended-svc-tyi-interrupt (os),

os-time-for-svc-tyi-handler (os))

= os-svc-tyi-handler (os))

Event: Disable trace-svc-tyi-handler.

Definition: os-intended-svc-tyo-interrupt (tm) = tm-set-memory (putnth (tm-pc (tm),

                        '0,

putnth (tm-sp (tm),

                               '1,

putnth (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                                     '2,

putnth (tm-svcid (tm),

                                            '8,

putseg (os-task-table (tm),

                                                   '15,

putseg (os-segment-table (tm),

                                                         '159,

putseg (os-readyq (tm),

                                                                '191,

putseg (os-status-table (tm),

                                                                      '211,

putseg (os-obuffers (tm),

                                                                             '371,

putseg (os-code (tm),

                                                                                   '2547,

tm-memory (tm))))))))))),

tm-set-pc ('2690,

tm-set-sp ('3310,

tm-set-svmode ('1,

tm-set-error ('0,

tm-set-rwstate ('0, tm))))))

Theorem: equivalence-of-svc-tyo-interrupt-expressions (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-execute-svc-interrupt (os) = os-intended-svc-tyo-interrupt (os))

Event: Disable equivalence-of-svc-tyo-interrupt-expressions.

Definition: os-time-for-svc-tyo-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-THRU-SAVE-STATE
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-SVCID OS)
      '8
      (PUTNTH
       (TM-R2 OS)
       '13
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (OS-READYQ OS)
           '191
           (PUTSEG (OS-STATUS-TABLE OS)

                 (PUTSEG (OS-OBUFFERS OS)
                         '371
                         (PUTSEG (OS-CODE OS)
                                 '2547
                                 (PUTNTH '2558
                                         '3309
                                         (PUTNTH '2692
                                                 '3310
                                                 (TM-MEMORY OS)))))))))))))))
(PUTNTH '2692
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (TM-R2 OS)
                        '2
                        (PUTNTH (TM-R3 OS)
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15
                                (TIMES '9
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '8))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyo-handler-thru-save-state (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-thru-save-state (os))

= os-svc-tyo-handler-thru-save-state (os))

Event: Disable trace-svc-tyo-handler-thru-save-state.

Definition: os-time-for-svc-tyo-handler-to-qfullp-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-TO-QFULLP-TEST
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '2
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-NEW-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG
            (OS-READYQ OS)
            '191
            (PUTSEG
                  (OS-STATUS-TABLE OS)

                (PUTSEG (OS-OBUFFERS OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '2930
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '2942
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                        '2
                        (PUTNTH (PLUS '371
                                      (TIMES '8
                                             (ARRAY-QFIRST (OS-READYQ OS))))
                                '3
                                (PUTNTH (GETNTH '3 (TM-REGS OS))
                                        '7
                                        (TM-REGS OS))))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '8
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '371))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyo-handler-to-qfullp-test (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '2))) → (tm-processor (os-svc-tyo-handler-thru-save-state (os),

os-time-for-svc-tyo-handler-to-qfullp-test (os))

= os-svc-tyo-handler-to-qfullp-test (os))

Event: Disable trace-svc-tyo-handler-to-qfullp-test.

Definition: os-time-for-svc-tyo-handler-to-dispatcher (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-TO-DISPATCHER
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '2
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-NEW-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG
            (ARRAY-DEQ (OS-READYQ OS))
            '191

          (PUTSEG
                (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                  '4
                                  '0
                                  OS)
                '211
                (PUTSEG (OS-OBUFFERS OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '2964
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3206
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                        '2
                        (PUTNTH (PLUS '211
                                      (TIMES '2
                                             (ARRAY-QFIRST (OS-READYQ OS))))
                                '3
                                (PUTNTH (GETNTH '3 (TM-REGS OS))
                                        '7
                                        (TM-REGS OS))))))
(TM-CC-VALUE (TM-ALU-PLUS (TIMES '2
                                 (ARRAY-QFIRST (OS-READYQ OS)))
                          '211))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyo-handler-to-dispatcher (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))))

→ (tm-processor (os-svc-tyo-handler-to-qfullp-test (os),

os-time-for-svc-tyo-handler-to-dispatcher (os))

= os-svc-tyo-handler-to-dispatcher (os))

Event: Disable trace-svc-tyo-handler-to-dispatcher.

Definition: os-time-for-svc-tyo-handler-to-wait-state (os)

= '(tick tick tick tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-PATH1
 (OS)
 (TM
  (PUTNTH
   (TM-R0 OS)
   '0
   (PUTNTH
    (TM-R1 OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH '2
      '8
      (PUTNTH
       (ARRAY-QFIRST (OS-READYQ OS))
       '12
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14

       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (ARRAY-DEQ (OS-READYQ OS))
          '191
          (PUTSEG
                (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                  '4
                                  '0
                                  OS)
                '211
                (PUTSEG (OS-OBUFFERS OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3211
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3222
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (ARRAY-QFIRST (OS-READYQ OS))
                        '2
                        (PUTNTH '191
                                '3
                                (PUTNTH (GETNTH '3 (TM-REGS OS))
                                        '7
                                        (TM-REGS OS))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1

  (TM-CLOCK OS)
  (TM-IPORTS OS)
  (TM-OPORTS OS))
 NIL)

Theorem: trace-svc-tyo-handler-to-wait-state (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (tm-processor (os-svc-tyo-handler-to-dispatcher (os),

os-time-for-svc-tyo-handler-to-wait-state (os))

= os-svc-tyo-handler-path1 (os))

Event: Disable trace-svc-tyo-handler-to-wait-state.

Definition: os-time-for-svc-tyo-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-PATH2
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
            (OS-NEW-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))))
             (OS-NEW-TASK-TABLE OS))
     '2
     (PUTNTH '2

    (PUTNTH
     (ARRAY-QFIRST (OS-READYQ OS))
     '12
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (ARRAY-DEQ (OS-READYQ OS))
          '191
          (PUTSEG
                (OS-UPDATE-STATUS (ARRAY-QFIRST (OS-READYQ OS))
                                  '4
                                  '0
                                  OS)
                '211
                (PUTSEG (OS-OBUFFERS OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3217
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)

(OS-NEW-BASE (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
             OS)
(OS-NEW-LIMIT (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyo-handler-to-lpsw (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-processor (os-svc-tyo-handler-to-dispatcher (os),

os-time-for-svc-tyo-handler-to-lpsw (os))

= os-svc-tyo-handler-path2 (os))

Event: Disable trace-svc-tyo-handler-to-lpsw.

Definition: os-time-for-svc-tyo-handler-thru-enqueue (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-THRU-ENQUEUE
(OS)
(TM
(PUTNTH
 (TM-R0 OS)
 '0
 (PUTNTH
  (TM-R1 OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2

(PUTNTH '2
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (OS-READYQ OS)
 '191
 (PUTSEG
       (OS-STATUS-TABLE OS)
       '211
       (PUTSEG (OS-OBUFFERS-WITH-ENQUEUED-CHARACTER OS)
               '371
               (PUTSEG (OS-CODE OS)
                       '2547
                       (PUTNTH '2558
                               '3309
                               (PUTNTH '2951
                                       '3310
                                       (TM-MEMORY OS))))))))))))))))
(PUTNTH '2951
'0
(PUTNTH '3310
'1
(PUTNTH
(GETNTH '3 (TM-REGS OS))
'2
(PUTNTH
(PLUS '371
      (TIMES '8
             (ARRAY-QFIRST (OS-READYQ OS))))
'3

         (PUTNTH (PLUS '375
                       (PLUS (TIMES '8
                                    (ARRAY-QFIRST (OS-READYQ OS)))
                             (GETNTH '1
                                     (GETNTH (ARRAY-QFIRST (OS-READYQ OS))
                                             (TABLE '8 (OS-OBUFFERS OS))))))
                 '4
                 (PUTNTH (GETNTH '3 (TM-REGS OS))
                         '7
                         (TM-REGS OS)))))))
(TM-CC-VALUE
            (TM-ALU-INCR-MOD (GETNTH '1
                                     (GETNTH (ARRAY-QFIRST (OS-READYQ OS))
                                             (TABLE '8 (OS-OBUFFERS OS))))
                             (GETNTH '3
                                     (GETNTH (ARRAY-QFIRST (OS-READYQ OS))
                                             (TABLE '8 (OS-OBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyo-handler-thru-enqueue (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os))))))

→ (tm-processor (os-svc-tyo-handler-to-qfullp-test (os),

os-time-for-svc-tyo-handler-thru-enqueue (os))

= os-svc-tyo-handler-thru-enqueue (os))

Event: Disable trace-svc-tyo-handler-thru-enqueue.

Definition: os-time-for-svc-tyo-handler-to-svcr1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

(DEFN OS-SVC-TYO-HANDLER-PATH3
(OS)
(TM
(PUTNTH
(GETNTH (TIMES '9
            (ARRAY-QFIRST (OS-READYQ OS)))
     (OS-NEW-TASK-TABLE OS))
'0
(PUTNTH
(GETNTH (PLUS '1
            (TIMES '9
                   (ARRAY-QFIRST (OS-READYQ OS))))
      (OS-NEW-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
             (TIMES '9
                    (ARRAY-QFIRST (OS-READYQ OS))))
       (OS-NEW-TASK-TABLE OS))
'2
(PUTNTH '2
'8
(PUTNTH
 (ARRAY-QFIRST (OS-READYQ OS))
 '12
 (PUTNTH
  (TM-R2 OS)
  '13
  (PUTNTH
   (TM-R3 OS)
   '14
   (PUTSEG
    (OS-NEW-TASK-TABLE OS)
    '15
    (PUTSEG
     (OS-SEGMENT-TABLE OS)
     '159

         (PUTSEG
          (OS-READYQ OS)
          '191
          (PUTSEG
                (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-OBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3229
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-POST-OUTPUT-INTERRUPT (ARRAY-QFIRST (OS-READYQ OS))
                          (TM-OPORTS OS)))
NIL)

Theorem: trace-svc-tyo-handler-to-svcr1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ tm-oport-idlep (array-qfirst (os-readyq (os)), tm-oports (os)))) → (tm-processor (os-svc-tyo-handler-thru-enqueue (os),

os-time-for-svc-tyo-handler-to-svcr1 (os))

= os-svc-tyo-handler-path3 (os))

Event: Disable trace-svc-tyo-handler-to-svcr1.

Definition: os-time-for-svc-tyo-handler-to-svcr2 (os)

= '(tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-SVC-TYO-HANDLER-PATH4
(OS)
(TM
(PUTNTH
(GETNTH (TIMES '9
       (ARRAY-QFIRST (OS-READYQ OS)))
(OS-NEW-TASK-TABLE OS))
'0
(PUTNTH
(GETNTH (PLUS '1
       (TIMES '9
              (ARRAY-QFIRST (OS-READYQ OS))))
 (OS-NEW-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
        (TIMES '9
               (ARRAY-QFIRST (OS-READYQ OS))))
  (OS-NEW-TASK-TABLE OS))
'2
(PUTNTH '2
'8
(PUTNTH
(ARRAY-QFIRST (OS-READYQ OS))
'12
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (OS-READYQ OS)

          (PUTSEG
                (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-OBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3229
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
'0
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-OPORTS OS))
NIL)

Theorem: trace-svc-tyo-handler-to-svcr2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os)))))

→ (tm-processor (os-svc-tyo-handler-thru-enqueue (os),

os-time-for-svc-tyo-handler-to-svcr2 (os))

= os-svc-tyo-handler-path4 (os))

Event: Disable trace-svc-tyo-handler-to-svcr2.

Definition: os-svc-tyo-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick

      tick tick tick tick tick tick tick tick tick tick)

Definition: os-svc-tyo-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

Definition: os-time-for-svc-tyo-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

Theorem: rewrite-svc-tyo-trace1 tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path1 (os))

= tm-processor (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-thru-save-state (os)),

os-svc-tyo-time1 (os))

Event: Disable rewrite-svc-tyo-trace1.

Theorem: rewrite-svc-tyo-trace2 tm-processor (os-svc-tyo-handler-thru-save-state (os), os-svc-tyo-time1 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-thru-save-state (os),

os-time-for-svc-tyo-handler-to-qfullp-test (os)),

os-svc-tyo-time2 (os))

Event: Disable rewrite-svc-tyo-trace2.

Theorem: rewrite-svc-tyo-trace3 tm-processor (os-svc-tyo-handler-to-qfullp-test (os), os-svc-tyo-time2 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-to-qfullp-test (os),

os-time-for-svc-tyo-handler-to-dispatcher (os)),

os-time-for-svc-tyo-handler-to-wait-state (os))

Event: Disable rewrite-svc-tyo-trace3.

Theorem: trace-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os)))))))

→ (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path1 (os))

= os-svc-tyo-handler-path1 (os))

Event: Disable trace-svc-tyo-handler-path1.

Definition: os-svc-tyo-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-svc-tyo-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Definition: os-time-for-svc-tyo-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Theorem: rewrite-svc-tyo-trace4 tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path2 (os))

= tm-processor (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-thru-save-state (os)),

os-svc-tyo-time3 (os))

Event: Disable rewrite-svc-tyo-trace4.

Theorem: rewrite-svc-tyo-trace5 tm-processor (os-svc-tyo-handler-thru-save-state (os), os-svc-tyo-time3 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-thru-save-state (os),

os-time-for-svc-tyo-handler-to-qfullp-test (os)),

os-svc-tyo-time4 (os))

Event: Disable rewrite-svc-tyo-trace5.

Theorem: rewrite-svc-tyo-trace6 tm-processor (os-svc-tyo-handler-to-qfullp-test (os), os-svc-tyo-time4 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-to-qfullp-test (os),

os-time-for-svc-tyo-handler-to-dispatcher (os)),

os-time-for-svc-tyo-handler-to-lpsw (os))

Event: Disable rewrite-svc-tyo-trace6.

Theorem: trace-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os))))))))

→ (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path2 (os))

= os-svc-tyo-handler-path2 (os))

Event: Disable trace-svc-tyo-handler-path2.

Definition: os-svc-tyo-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Definition: os-svc-tyo-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-time-for-svc-tyo-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick)

Theorem: rewrite-svc-tyo-trace7 tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path3 (os))

= tm-processor (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-thru-save-state (os)),

os-svc-tyo-time5 (os))

Event: Disable rewrite-svc-tyo-trace7.

Theorem: rewrite-svc-tyo-trace8 tm-processor (os-svc-tyo-handler-thru-save-state (os), os-svc-tyo-time5 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-thru-save-state (os),

os-time-for-svc-tyo-handler-to-qfullp-test (os)),

os-svc-tyo-time6 (os))

Event: Disable rewrite-svc-tyo-trace8.

Theorem: rewrite-svc-tyo-trace9 tm-processor (os-svc-tyo-handler-to-qfullp-test (os), os-svc-tyo-time6 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-to-qfullp-test (os),

os-time-for-svc-tyo-handler-thru-enqueue (os)),

os-time-for-svc-tyo-handler-to-svcr1 (os))

Event: Disable rewrite-svc-tyo-trace9.

Theorem: trace-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os))))))

→ (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path3 (os))

= os-svc-tyo-handler-path3 (os))

Event: Disable trace-svc-tyo-handler-path3.

Definition: os-svc-tyo-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Definition: os-svc-tyo-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

Definition: os-time-for-svc-tyo-handler-path4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick

      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Theorem: rewrite-svc-tyo-trace10 tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path4 (os))

= tm-processor (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-thru-save-state (os)),

os-svc-tyo-time7 (os))

Event: Disable rewrite-svc-tyo-trace10.

Theorem: rewrite-svc-tyo-trace11 tm-processor (os-svc-tyo-handler-thru-save-state (os), os-svc-tyo-time7 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-thru-save-state (os),

os-time-for-svc-tyo-handler-to-qfullp-test (os)),

os-svc-tyo-time8 (os))

Event: Disable rewrite-svc-tyo-trace11.

Theorem: rewrite-svc-tyo-trace12 tm-processor (os-svc-tyo-handler-to-qfullp-test (os), os-svc-tyo-time8 (os)) = tm-processor (tm-processor (os-svc-tyo-handler-to-qfullp-test (os),

os-time-for-svc-tyo-handler-thru-enqueue (os)),

os-time-for-svc-tyo-handler-to-svcr2 (os))

Event: Disable rewrite-svc-tyo-trace12.

Theorem: trace-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ (¬ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os)))))))

→ (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler-path4 (os))

= os-svc-tyo-handler-path4 (os))

Event: Disable trace-svc-tyo-handler-path4.

Definition: os-time-for-svc-tyo-handler (os) = if array-qfullp (os-current-obuffer (os-current-taskid (os), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-time-for-svc-tyo-handler-path1 (os) else os-time-for-svc-tyo-handler-path2 (os) endif elseif tm-oport-idlep (array-qfirst (os-readyq (os)), tm-oports (os)) then os-time-for-svc-tyo-handler-path3 (os) else os-time-for-svc-tyo-handler-path4 (os) endif

Definition: os-svc-tyo-handler (os) = if array-qfullp (os-current-obuffer (os-current-taskid (os), os))

then if array-qemptyp (array-deq (os-readyq (os))) then os-svc-tyo-handler-path1 (os) else os-svc-tyo-handler-path2 (os) endif

elseif tm-oport-idlep (array-qfirst (os-readyq (os)), tm-oports (os)) then os-svc-tyo-handler-path3 (os) else os-svc-tyo-handler-path4 (os) endif

Theorem: trace-svc-tyo-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((tm-svcid (os) mod '4) = '2))) → (tm-processor (os-intended-svc-tyo-interrupt (os),

os-time-for-svc-tyo-handler (os))

= os-svc-tyo-handler (os))

Event: Disable trace-svc-tyo-handler.

(DEFN
 OS-INTENDED-INPUT-INTERRUPT
 (TM)
 (TM-SET-MEMORY
  (PUTNTH
   (TM-PC TM)
   '0
   (PUTNTH
    (TM-SP TM)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC TM)
                  (TM-ERROR TM)
                  (TM-SVCFLAG TM)

                  (TM-SVCID TM))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS TM))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS TM))
                         (TM-IPORTS TM)))
       '9
       (PUTSEG
              (OS-TASK-TABLE TM)
              '15
              (PUTSEG (OS-SEGMENT-TABLE TM)
                      '159
                      (PUTSEG (OS-READYQ TM)
                              '191
                              (PUTSEG (OS-STATUS-TABLE TM)
                                      '211
                                      (PUTSEG (OS-IBUFFERS TM)
                                              '243
                                              (PUTSEG (OS-CODE TM)
                                                      '2547
                                                      (TM-MEMORY TM))))))))))))
  (TM-SET-PC '3042
   (TM-SET-SP '3310
    (TM-SET-SVMODE '1
     (TM-SET-ERROR '0
      (TM-SET-RWSTATE '0
       (TM-SET-IPORTS
          (TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS TM))
                                    (TM-IPORTS TM))
          TM)))))))
 NIL)

Theorem: equivalence-of-input-interrupt-expressions good-os (os) → (tm-execute-input-interrupt (os) = os-intended-input-interrupt (os))

Event: Disable equivalence-of-input-interrupt-expressions.

Definition: os-time-for-waiting-input-handler-thru-readyq-empty-test (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-THRU-READYQ-EMPTY-TEST
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
 (TM-SP OS)
 '1
 (PUTNTH
  (TM-PACK-PSW (TM-CC OS)
               (TM-ERROR OS)
               (TM-SVCFLAG OS)
               (TM-SVCID OS))
  '2
  (PUTNTH
   (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
   '8
   (PUTNTH
    (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      (TM-IPORTS OS)))
    '9
    (PUTNTH '3206
     '10
     (PUTNTH
      (TM-R3 OS)
      '14
      (PUTSEG
       (OS-TASK-TABLE OS)
       '15
       (PUTSEG
        (OS-SEGMENT-TABLE OS)
        '159
        (PUTSEG (OS-READYQ OS)
                '191
                (PUTSEG (OS-STATUS-TABLE OS)
                        '211
                        (PUTSEG (OS-IBUFFERS OS)
                                '243
                                (PUTSEG (OS-CODE OS)
                                        '2547
                                        (PUTNTH '3053

                                                 (TM-MEMORY OS)))))))))))))))
(PUTNTH '3063
        '0
        (PUTNTH '3310
                '1
                (PUTNTH '191 '3 (TM-REGS OS))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-thru-readyq-empty-test (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os))

= os-waiting-input-handler-thru-readyq-empty-test (os))

Event: Disable trace-waiting-input-handler-thru-readyq-empty-test.

Definition: os-time-for-waiting-input-handler-to-ibuffer-full-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-IBUFFER-FULL-TEST
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0

(PUTNTH
(TM-SP OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'8
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
       (TM-IPORTS OS)))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
     (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                  '0
                  '0
                  OS)
'211
(PUTSEG (OS-IBUFFERS OS)
        '243
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '3085
                        '3310
                        (TM-MEMORY OS)))))))))))))))

(PUTNTH '3091
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
   '2
   (PUTNTH '191
    '3
    (PUTNTH
           (PLUS '195
                 (GETNTH '1 (OS-READYQ OS)))
           '4
           (PUTNTH (PLUS '211
                         (TIMES '2
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   '5
                   (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1 (OS-READYQ OS))
                              '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-ibuffer-full-test (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os), os-time-for-waiting-input-handler-to-ibuffer-full-test (os))

= os-waiting-input-handler-to-ibuffer-full-test (os))

Event: Disable trace-waiting-input-handler-to-ibuffer-full-test.

Definition: os-time-for-waiting-input-handler-to-dispatcher1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-DISPATCHER1
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3206
        '10
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159

(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
           (OS-READYQ OS))
'191
(PUTSEG
      (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                        '0
                        '0
                        OS)
      '211
      (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
              '243
              (PUTSEG (OS-CODE OS)
                      '2547
                      (PUTNTH '3112
                              '3310
                              (TM-MEMORY OS)))))))))))))))
(PUTNTH '3206
'0
(PUTNTH '3310
'1
(PUTNTH
(PLUS '256
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                 (TM-IPORTS OS))))
'2
(PUTNTH
(PLUS '243
(TIMES '8
       (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
'3
(PUTNTH
(PLUS '247
(PLUS
(TIMES '8
     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
(DECR-MOD (GETNTH '1
                (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                        (TABLE '8 (OS-IBUFFERS OS))))
        '4)))
'4
(PUTNTH (PLUS '211
         (TIMES '2
                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))

             (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-PLUS
  (PLUS '243
   (PLUS
        (TIMES '8
               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
        (DECR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  '4)))
  '4))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-dispatcher1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-time-for-waiting-input-handler-to-dispatcher1 (os))

= os-waiting-input-handler-to-dispatcher1 (os))

Event: Disable trace-waiting-input-handler-to-dispatcher1.

Definition: os-time-for-waiting-input-handler-to-dispatcher2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-DISPATCHER2
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
(TM-SP OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'8
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
       (TM-IPORTS OS)))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
     (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                  '0
                  '0
                  OS)

                (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '3126
                                        '3310
                                        (TM-MEMORY OS)))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (PLUS '256
         (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TM-IPORTS OS))))
   '2
   (PUTNTH
    (PLUS '243
          (TIMES '8
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)

(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-dispatcher2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))

→ (tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-time-for-waiting-input-handler-to-dispatcher2 (os))

= os-waiting-input-handler-to-dispatcher2 (os))

Event: Disable trace-waiting-input-handler-to-dispatcher2.

Definition: os-time-for-waiting-input-handler-to-dispatcher3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-DISPATCHER3
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0
 (PUTNTH
  (TM-SP OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)

(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'8
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
       (TM-IPORTS OS)))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
     (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                  '0
                  '0
                  OS)
'211
(PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
        '243
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '3133
                        '3310
                        (TM-MEMORY OS)))))))))))))))
(PUTNTH '3206
'0
(PUTNTH '3310
'1
(PUTNTH

   (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                     (TM-IPORTS OS)))
   '2
   (PUTNTH
    (PLUS '243
          (TIMES '8
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-dispatcher3 (good-os (os)

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-time-for-waiting-input-handler-to-dispatcher3 (os))

= os-waiting-input-handler-to-dispatcher3 (os))

Event: Disable trace-waiting-input-handler-to-dispatcher3.

Definition: os-time-for-waiting-input-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-PATH1
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
           (OS-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
            (OS-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
             (OS-TASK-TABLE OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8

(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
               (TM-IPORTS OS)))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
 (OS-SEGMENT-TABLE OS)
 '159
 (PUTSEG
  (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
             (OS-READYQ OS))
  '191
  (PUTSEG
        (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          '0
                          '0
                          OS)
        '211
        (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
                '243
                (PUTSEG (OS-CODE OS)
                        '2547
                        (PUTNTH '3217
                                '3310
                                (TM-MEMORY OS)))))))))))))))
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
        (TABLE '9 (OS-TASK-TABLE OS))))
(REMAINDER (GETNTH (PLUS '8
                 (TIMES '9
                        (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
           (OS-TASK-TABLE OS))
   '4)
(QUOTIENT
(REMAINDER
   (GETNTH (PLUS '8

                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '256)
 '4)
(QUOTIENT
 (REMAINDER
           (GETNTH (PLUS '8
                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '512)
 '256)
(QUOTIENT (GETNTH (PLUS '8
                        (TIMES '9
                               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                  (OS-TASK-TABLE OS))
          '512)
(BASE (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
              (TABLE '2 (OS-SEGMENT-TABLE OS))))
(LIMIT (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
               (TABLE '2 (OS-SEGMENT-TABLE OS))))
(TM-SLIMIT OS)
'0
'0
'1000
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-lpsw1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-input-handler-to-dispatcher1 (os),

os-time-for-waiting-input-handler-to-lpsw (os))

= os-waiting-input-handler-path1 (os))

Event: Disable trace-waiting-input-handler-to-lpsw1.

(DEFN
OS-WAITING-INPUT-HANDLER-PATH2

(OS)
(TM
(PUTNTH
(GETNTH (TIMES '9
       (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
(OS-TASK-TABLE OS))
'0
(PUTNTH
(GETNTH (PLUS '1
       (TIMES '9
              (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
 (OS-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
        (TIMES '9
               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
  (OS-TASK-TABLE OS))
'2
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'8
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
              (TM-IPORTS OS)))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
            (OS-READYQ OS))
 '191
 (PUTSEG
       (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         '0

                                  OS)
                '211
                (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
                        '243
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '3217
                                        '3310
                                        (TM-MEMORY OS)))))))))))))))
(GETSEG '0
        '8
        (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                (TABLE '9 (OS-TASK-TABLE OS))))
(REMAINDER (GETNTH (PLUS '8
                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '4)
(QUOTIENT
 (REMAINDER
           (GETNTH (PLUS '8
                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '256)
 '4)
(QUOTIENT
 (REMAINDER
           (GETNTH (PLUS '8
                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '512)
 '256)
(QUOTIENT (GETNTH (PLUS '8
                        (TIMES '9
                               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                  (OS-TASK-TABLE OS))
          '512)
(BASE (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
              (TABLE '2 (OS-SEGMENT-TABLE OS))))
(LIMIT (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
               (TABLE '2 (OS-SEGMENT-TABLE OS))))

(TM-SLIMIT OS)
'0
'0
'1000
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-lpsw2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-input-handler-to-dispatcher2 (os),

os-time-for-waiting-input-handler-to-lpsw (os))

= os-waiting-input-handler-path2 (os))

Event: Disable trace-waiting-input-handler-to-lpsw2.

(DEFN
OS-WAITING-INPUT-HANDLER-PATH3
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
         (OS-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
          (OS-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8
                 (TIMES '9
                        (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
           (OS-TASK-TABLE OS))
   '2
   (PUTNTH
    (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
    '8

(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
               (TM-IPORTS OS)))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
 (OS-SEGMENT-TABLE OS)
 '159
 (PUTSEG
  (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
             (OS-READYQ OS))
  '191
  (PUTSEG
        (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          '0
                          '0
                          OS)
        '211
        (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                '243
                (PUTSEG (OS-CODE OS)
                        '2547
                        (PUTNTH '3217
                                '3310
                                (TM-MEMORY OS)))))))))))))))
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
        (TABLE '9 (OS-TASK-TABLE OS))))
(REMAINDER (GETNTH (PLUS '8
                 (TIMES '9
                        (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
           (OS-TASK-TABLE OS))
   '4)
(QUOTIENT
(REMAINDER
   (GETNTH (PLUS '8

                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '256)
 '4)
(QUOTIENT
 (REMAINDER
           (GETNTH (PLUS '8
                         (TIMES '9
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   (OS-TASK-TABLE OS))
           '512)
 '256)
(QUOTIENT (GETNTH (PLUS '8
                        (TIMES '9
                               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                  (OS-TASK-TABLE OS))
          '512)
(BASE (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
              (TABLE '2 (OS-SEGMENT-TABLE OS))))
(LIMIT (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
               (TABLE '2 (OS-SEGMENT-TABLE OS))))
(TM-SLIMIT OS)
'0
'0
'1000
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-lpsw3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-input-handler-to-dispatcher3 (os),

os-time-for-waiting-input-handler-to-lpsw (os))

= os-waiting-input-handler-path3 (os))

Event: Disable trace-waiting-input-handler-to-lpsw3.

Definition: os-waiting-input-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-waiting-input-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick)

Definition: os-time-for-waiting-input-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Theorem: rewrite-waiting-input-trace1 tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path1 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os)),

os-waiting-input-time1 (os))

Event: Disable rewrite-waiting-input-trace1.

Theorem: rewrite-waiting-input-trace2 tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-waiting-input-time1 (os))

= tm-processor (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test (os)),

os-waiting-input-time2 (os))

Event: Disable rewrite-waiting-input-trace2.

Theorem: rewrite-waiting-input-trace3 tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-waiting-input-time2 (os))

= tm-processor (tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-time-for-waiting-input-handler-to-dispatcher1 (os)),

os-time-for-waiting-input-handler-to-lpsw (os))

Event: Disable rewrite-waiting-input-trace3.

Theorem: trace-waiting-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

         = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path1 (os))

= os-waiting-input-handler-path1 (os))

Event: Disable trace-waiting-input-handler-path1.

Definition: os-waiting-input-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick)

Definition: os-waiting-input-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

Definition: os-time-for-waiting-input-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Theorem: rewrite-waiting-input-trace4 tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path2 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os)),

os-waiting-input-time3 (os))

Event: Disable rewrite-waiting-input-trace4.

Theorem: rewrite-waiting-input-trace5 tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-waiting-input-time3 (os))

= tm-processor (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test (os)),

os-waiting-input-time4 (os))

Event: Disable rewrite-waiting-input-trace5.

Theorem: rewrite-waiting-input-trace6 tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-waiting-input-time4 (os))

= tm-processor (tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-time-for-waiting-input-handler-to-dispatcher2 (os)),

os-time-for-waiting-input-handler-to-lpsw (os))

Event: Disable rewrite-waiting-input-trace6.

Theorem: trace-waiting-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

         = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path2 (os))

= os-waiting-input-handler-path2 (os))

Event: Disable trace-waiting-input-handler-path2.

Definition: os-waiting-input-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick)

Definition: os-waiting-input-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Definition: os-time-for-waiting-input-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Theorem: rewrite-waiting-input-trace7 tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path3 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os)),

os-waiting-input-time5 (os))

Event: Disable rewrite-waiting-input-trace7.

Theorem: rewrite-waiting-input-trace8 tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-waiting-input-time5 (os))

= tm-processor (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test (os)),

os-waiting-input-time6 (os))

Event: Disable rewrite-waiting-input-trace8.

Theorem: rewrite-waiting-input-trace9 tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-waiting-input-time6 (os))

= tm-processor (tm-processor (os-waiting-input-handler-to-ibuffer-full-test (os),

os-time-for-waiting-input-handler-to-dispatcher3 (os)),

os-time-for-waiting-input-handler-to-lpsw (os))

Event: Disable rewrite-waiting-input-trace9.

Theorem: trace-waiting-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path3 (os))

= os-waiting-input-handler-path3 (os))

Event: Disable trace-waiting-input-handler-path3.

Definition: os-time-for-waiting-input-handler-to-ibuffer-full-test2 (os)

= '(tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-IBUFFER-FULL-TEST2
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3206
        '10
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG (OS-READYQ OS)
                   '191
                   (PUTSEG (OS-STATUS-TABLE OS)
                           '211
                           (PUTSEG (OS-IBUFFERS OS)

                                 (PUTSEG (OS-CODE OS)
                                         '2547
                                         (PUTNTH '3053
                                                 '3310
                                                 (TM-MEMORY OS)))))))))))))))
(PUTNTH '3091
 '0
 (PUTNTH '3310
   '1
   (PUTNTH '191
           '3
           (PUTNTH (PLUS '211
                         (TIMES '2
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   '5
                   (TM-REGS OS)))))
(TM-CC-VALUE
 (TM-ALU-DIFFERENCE
                  (GETNTH (TIMES '2
                                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                          (OS-STATUS-TABLE OS))
                  '5))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-ibuffer-full-test2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

≠ '5))))

→ (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test2 (os))

= os-waiting-input-handler-to-ibuffer-full-test2 (os))

Event: Disable trace-waiting-input-handler-to-ibuffer-full-test2.

Definition: os-time-for-waiting-input-handler-to-dispatcher4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-DISPATCHER4
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3206
        '10
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-TASK-TABLE OS)
          '15

(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
  (OS-READYQ OS)
  '191
  (PUTSEG (OS-STATUS-TABLE OS)
          '211
          (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
                  '243
                  (PUTSEG (OS-CODE OS)
                          '2547
                          (PUTNTH '3112
                                  '3310
                                  (TM-MEMORY OS)))))))))))))))
(PUTNTH '3206
'0
(PUTNTH '3310
'1
(PUTNTH
(PLUS '256
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                  (TM-IPORTS OS))))
'2
(PUTNTH
(PLUS '243
 (TIMES '8
        (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
'3
(PUTNTH
(PLUS '247
(PLUS
(TIMES '8
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
(DECR-MOD (GETNTH '1
                 (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TABLE '8 (OS-IBUFFERS OS))))
         '4)))
'4
(PUTNTH (PLUS '211
          (TIMES '2
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '5
    (TM-REGS OS)))))))

(TM-CC-VALUE
 (TM-ALU-PLUS
  (PLUS '243
   (PLUS
        (TIMES '8
               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
        (DECR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  '4)))
  '4))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-dispatcher4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-time-for-waiting-input-handler-to-dispatcher4 (os))

= os-waiting-input-handler-to-dispatcher4 (os))

Event: Disable trace-waiting-input-handler-to-dispatcher4.

Definition: os-time-for-waiting-input-handler-to-dispatcher5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-DISPATCHER5
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
 (TM-SP OS)
 '1
 (PUTNTH
  (TM-PACK-PSW (TM-CC OS)
               (TM-ERROR OS)
               (TM-SVCFLAG OS)
               (TM-SVCID OS))
  '2
  (PUTNTH
   (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
   '8
   (PUTNTH
    (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      (TM-IPORTS OS)))
    '9
    (PUTNTH '3206
     '10
     (PUTNTH
      (TM-R3 OS)
      '14
      (PUTSEG
       (OS-TASK-TABLE OS)
       '15
       (PUTSEG
        (OS-SEGMENT-TABLE OS)
        '159
        (PUTSEG
           (OS-READYQ OS)
           '191
           (PUTSEG (OS-STATUS-TABLE OS)
                   '211
                   (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
                           '243
                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '3126
                                           '3310

                                            (TM-MEMORY OS)))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (PLUS '256
         (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TM-IPORTS OS))))
   '2
   (PUTNTH
    (PLUS '243
          (TIMES '8
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)

  (TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                            (TM-IPORTS OS))
  (TM-OPORTS OS))
 NIL)

Theorem: trace-waiting-input-handler-to-dispatcher5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))

→ (tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-time-for-waiting-input-handler-to-dispatcher5 (os))

= os-waiting-input-handler-to-dispatcher5 (os))

Event: Disable trace-waiting-input-handler-to-dispatcher5.

Definition: os-time-for-waiting-input-handler-to-dispatcher6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-TO-DISPATCHER6
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8

(PUTNTH
 (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                   (TM-IPORTS OS)))
 '9
 (PUTNTH '3206
  '10
  (PUTNTH
   (TM-R3 OS)
   '14
   (PUTSEG
    (OS-TASK-TABLE OS)
    '15
    (PUTSEG
     (OS-SEGMENT-TABLE OS)
     '159
     (PUTSEG (OS-READYQ OS)
             '191
             (PUTSEG (OS-STATUS-TABLE OS)
                     '211
                     (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                             '243
                             (PUTSEG (OS-CODE OS)
                                     '2547
                                     (PUTNTH '3133
                                             '3310
                                             (TM-MEMORY OS)))))))))))))))
(PUTNTH '3206
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                 (TM-IPORTS OS)))
'2
(PUTNTH
(PLUS '243
      (TIMES '8
             (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
'3
(PUTNTH
  (PLUS '247
        (PLUS (TIMES '8
                     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
              (GETNTH '1

                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-dispatcher6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-time-for-waiting-input-handler-to-dispatcher6 (os))

= os-waiting-input-handler-to-dispatcher6 (os))

Event: Disable trace-waiting-input-handler-to-dispatcher6.

Definition: os-time-for-waiting-input-handler-to-wait (os)

= '(tick tick tick tick tick tick)

(DEFN OS-WAITING-INPUT-HANDLER-PATH4
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3206
        '10
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG
             (OS-READYQ OS)
             '191
             (PUTSEG (OS-STATUS-TABLE OS)
                     '211
                     (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)

                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '3211
                                           '3310
                                           (TM-MEMORY OS)))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (PLUS '256
         (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TM-IPORTS OS))))
   '2
   (PUTNTH '191
    '3
    (PUTNTH
     (PLUS '247
      (PLUS
        (TIMES '8
               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
        (DECR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  '4)))
     '4
     (PUTNTH (PLUS '211
                   (TIMES '2
                          (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
             '5
             (TM-REGS OS)))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))

 (TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-wait1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-input-handler-to-dispatcher4 (os),

os-time-for-waiting-input-handler-to-wait (os))

= os-waiting-input-handler-path4 (os))

Event: Disable trace-waiting-input-handler-to-wait1.

(DEFN
OS-WAITING-INPUT-HANDLER-PATH5
(OS)
(TM
 (PUTNTH
  (TM-PC OS)
  '0
  (PUTNTH
   (TM-SP OS)
   '1
   (PUTNTH
    (TM-PACK-PSW (TM-CC OS)
                 (TM-ERROR OS)
                 (TM-SVCFLAG OS)
                 (TM-SVCID OS))
    '2
    (PUTNTH
     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
     '8
     (PUTNTH
      (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                        (TM-IPORTS OS)))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-TASK-TABLE OS)

        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
            (OS-READYQ OS)
            '191
            (PUTSEG (OS-STATUS-TABLE OS)
                    '211
                    (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
                            '243
                            (PUTSEG (OS-CODE OS)
                                    '2547
                                    (PUTNTH '3211
                                            '3310
                                            (TM-MEMORY OS)))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (PLUS '256
         (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TM-IPORTS OS))))
   '2
   (PUTNTH '191
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)

(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-wait2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-input-handler-to-dispatcher5 (os),

os-time-for-waiting-input-handler-to-wait (os))

= os-waiting-input-handler-path5 (os))

Event: Disable trace-waiting-input-handler-to-wait2.

(DEFN
OS-WAITING-INPUT-HANDLER-PATH6
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0
 (PUTNTH
  (TM-SP OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)
                (TM-ERROR OS)
                (TM-SVCFLAG OS)
                (TM-SVCID OS))
   '2
   (PUTNTH
    (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
    '8
    (PUTNTH
     (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                       (TM-IPORTS OS)))

(PUTNTH '3206
'10
(PUTNTH
 (TM-R3 OS)
 '14
 (PUTSEG
  (OS-TASK-TABLE OS)
  '15
  (PUTSEG
   (OS-SEGMENT-TABLE OS)
   '159
   (PUTSEG (OS-READYQ OS)
           '191
           (PUTSEG (OS-STATUS-TABLE OS)
                   '211
                   (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                           '243
                           (PUTSEG (OS-CODE OS)
                                   '2547
                                   (PUTNTH '3211
                                           '3310
                                           (TM-MEMORY OS)))))))))))))))
(PUTNTH '3222
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
               (TM-IPORTS OS)))
'2
(PUTNTH '191
'3
(PUTNTH
(PLUS '247
      (PLUS (TIMES '8
                   (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
            (GETNTH '1
                    (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                            (TABLE '8 (OS-IBUFFERS OS))))))
'4
(PUTNTH (PLUS '211
              (TIMES '2
                     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))

              (TM-REGS OS)))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-waiting-input-handler-to-wait3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-input-handler-to-dispatcher6 (os),

os-time-for-waiting-input-handler-to-wait (os))

= os-waiting-input-handler-path6 (os))

Event: Disable trace-waiting-input-handler-to-wait3.

Definition: os-waiting-input-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick)

Definition: os-waiting-input-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick)

Definition: os-time-for-waiting-input-handler-path4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick)

Theorem: rewrite-waiting-input-trace10 tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path4 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os)),

os-waiting-input-time7 (os))

Event: Disable rewrite-waiting-input-trace10.

Theorem: rewrite-waiting-input-trace11 tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-waiting-input-time7 (os))

= tm-processor (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test2 (os)),

os-waiting-input-time8 (os))

Event: Disable rewrite-waiting-input-trace11.

Theorem: rewrite-waiting-input-trace12 tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-waiting-input-time8 (os))

= tm-processor (tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-time-for-waiting-input-handler-to-dispatcher4 (os)),

os-time-for-waiting-input-handler-to-wait (os))

Event: Disable rewrite-waiting-input-trace12.

Theorem: trace-waiting-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path4 (os))

= os-waiting-input-handler-path4 (os))

Event: Disable trace-waiting-input-handler-path4.

Definition: os-waiting-input-time9 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick)

Definition: os-waiting-input-time10 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick)

Definition: os-time-for-waiting-input-handler-path5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Theorem: rewrite-waiting-input-trace13 tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path5 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os)),

os-waiting-input-time9 (os))

Event: Disable rewrite-waiting-input-trace13.

Theorem: rewrite-waiting-input-trace14 tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-waiting-input-time9 (os))

= tm-processor (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test2 (os)),

os-waiting-input-time10 (os))

Event: Disable rewrite-waiting-input-trace14.

Theorem: rewrite-waiting-input-trace15 tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-waiting-input-time10 (os))

= tm-processor (tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-time-for-waiting-input-handler-to-dispatcher5 (os)),

os-time-for-waiting-input-handler-to-wait (os))

Event: Disable rewrite-waiting-input-trace15.

Theorem: trace-waiting-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path5 (os))

= os-waiting-input-handler-path5 (os))

Event: Disable trace-waiting-input-handler-path5.

Definition: os-waiting-input-time11 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick)

Definition: os-waiting-input-time12 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

Definition: os-time-for-waiting-input-handler-path6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

Theorem: rewrite-waiting-input-trace16 tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path6 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-thru-readyq-empty-test (os)),

os-waiting-input-time11 (os))

Event: Disable rewrite-waiting-input-trace16.

Theorem: rewrite-waiting-input-trace17 tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-waiting-input-time11 (os))

= tm-processor (tm-processor (os-waiting-input-handler-thru-readyq-empty-test (os),

os-time-for-waiting-input-handler-to-ibuffer-full-test2 (os)),

os-waiting-input-time12 (os))

Event: Disable rewrite-waiting-input-trace17.

Theorem: rewrite-waiting-input-trace18 tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-waiting-input-time12 (os))

= tm-processor (tm-processor (os-waiting-input-handler-to-ibuffer-full-test2 (os),

os-time-for-waiting-input-handler-to-dispatcher6 (os)),

os-time-for-waiting-input-handler-to-wait (os))

Event: Disable rewrite-waiting-input-trace18.

Theorem: trace-waiting-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler-path6 (os))

= os-waiting-input-handler-path6 (os))

Event: Disable trace-waiting-input-handler-path6.

Definition: os-time-for-waiting-input-handler (os) = if getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

  = '5

then if array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-time-for-waiting-input-handler-path1 (os)

elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))

then os-time-for-waiting-input-handler-path2 (os) else os-time-for-waiting-input-handler-path3 (os) endif

elseif array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-time-for-waiting-input-handler-path4 (os) elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

then os-time-for-waiting-input-handler-path5 (os) else os-time-for-waiting-input-handler-path6 (os) endif

Definition: os-waiting-input-handler (os) = if getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

  = '5

then if array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-waiting-input-handler-path1 (os)

elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))

then os-waiting-input-handler-path2 (os) else os-waiting-input-handler-path3 (os) endif

elseif array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-waiting-input-handler-path4 (os) elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

then os-waiting-input-handler-path5 (os) else os-waiting-input-handler-path6 (os) endif

Theorem: trace-waiting-input-handler (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (tm-processor (os-intended-input-interrupt (os),

os-time-for-waiting-input-handler (os))

= os-waiting-input-handler (os))

Event: Disable trace-waiting-input-handler.

Definition: os-time-for-running-input-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-THRU-SAVE-STATE
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3231
        '10
        (PUTNTH
         (TM-R2 OS)
         '13
         (PUTNTH
          (TM-R3 OS)
          '14
          (PUTSEG
           (OS-NEW-TASK-TABLE OS)
           '15
           (PUTSEG
            (OS-SEGMENT-TABLE OS)

          (PUTSEG
           (OS-READYQ OS)
           '191
           (PUTSEG
               (OS-STATUS-TABLE OS)
               '211
               (PUTSEG (OS-IBUFFERS OS)
                       '243
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3063
                                               '3310
                                               (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3063
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (GETNTH '2 (TM-REGS OS))
                        '2
                        (PUTNTH (GETNTH '3 (TM-REGS OS))
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15
                                (TIMES '9
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '8))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-thru-save-state (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os))

= os-running-input-handler-thru-save-state (os))

Event: Disable trace-running-input-handler-thru-save-state.

Definition: os-time-for-running-input-handler-to-ibuffer-full-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-IBUFFER-FULL-TEST
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3231
        '10
        (PUTNTH
         (TM-R2 OS)
         '13
         (PUTNTH
          (TM-R3 OS)

(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
           (OS-READYQ OS))
'191
(PUTSEG
    (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      '0
                      '0
                      OS)
    '211
    (PUTSEG (OS-IBUFFERS OS)
            '243
            (PUTSEG (OS-CODE OS)
                    '2547
                    (PUTNTH '2558
                            '3309
                            (PUTNTH '3085
                                    '3310
                                    (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3091
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'2
(PUTNTH '191
'3
(PUTNTH
(PLUS '195
      (GETNTH '1 (OS-READYQ OS)))
'4
(PUTNTH (PLUS '211
              (TIMES '2
                     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
        '5
        (TM-REGS OS)))))))

(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1 (OS-READYQ OS))
                              '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-ibuffer-full-test (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test (os))

= os-running-input-handler-to-ibuffer-full-test (os))

Event: Disable trace-running-input-handler-to-ibuffer-full-test.

Definition: os-time-for-running-input-handler-to-resume-task1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-RESUME-TASK1
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0
 (PUTNTH

(TM-SP OS)
'1
(PUTNTH
 (TM-PACK-PSW (TM-CC OS)
              (TM-ERROR OS)
              (TM-SVCFLAG OS)
              (TM-SVCID OS))
 '2
 (PUTNTH
  (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
  '8
  (PUTNTH
   (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                     (TM-IPORTS OS)))
   '9
   (PUTNTH '3231
    '10
    (PUTNTH
     (TM-R2 OS)
     '13
     (PUTNTH
      (TM-R3 OS)
      '14
      (PUTSEG
       (OS-NEW-TASK-TABLE OS)
       '15
       (PUTSEG
        (OS-SEGMENT-TABLE OS)
        '159
        (PUTSEG
         (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                    (OS-READYQ OS))
         '191
         (PUTSEG
             (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                               '0
                               '0
                               OS)
             '211
             (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
                     '243
                     (PUTSEG (OS-CODE OS)
                             '2547
                             (PUTNTH '2558

                                     (PUTNTH '3112
                                             '3310
                                             (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3231
'0
(PUTNTH '3310
'1
(PUTNTH
 (PLUS '256
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS))))
 '2
 (PUTNTH
  (PLUS '243
        (TIMES '8
               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
  '3
  (PUTNTH
   (PLUS '247
    (PLUS
      (TIMES '8
             (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
      (DECR-MOD (GETNTH '1
                        (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                (TABLE '8 (OS-IBUFFERS OS))))
                '4)))
   '4
   (PUTNTH (PLUS '211
                 (TIMES '2
                        (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
           '5
           (TM-REGS OS)))))))
(TM-CC-VALUE
(TM-ALU-PLUS
(PLUS '243
 (PLUS
      (TIMES '8
             (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
      (DECR-MOD (GETNTH '1
                        (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                (TABLE '8 (OS-IBUFFERS OS))))
                '4)))
'4))

(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-resume-task1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-time-for-running-input-handler-to-resume-task1 (os))

= os-running-input-handler-to-resume-task1 (os))

Event: Disable trace-running-input-handler-to-resume-task1.

Definition: os-time-for-running-input-handler-to-resume-task2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-RESUME-TASK2
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0
 (PUTNTH
  (TM-SP OS)
  '1
  (PUTNTH
   (TM-PACK-PSW (TM-CC OS)

(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'8
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
       (TM-IPORTS OS)))
'9
(PUTNTH '3231
'10
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      (OS-READYQ OS))
'191
(PUTSEG
(OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                 '0
                 '0
                 OS)
'211
(PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
       '243
       (PUTSEG (OS-CODE OS)
               '2547
               (PUTNTH '2558
                       '3309
                       (PUTNTH '3126
                               '3310
                               (TM-MEMORY OS)))))))))))))))))

(PUTNTH '3231
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (PLUS '256
         (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TM-IPORTS OS))))
   '2
   (PUTNTH
    (PLUS '243
          (TIMES '8
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))

                            (TM-IPORTS OS))
  (TM-OPORTS OS))
 NIL)

Theorem: trace-running-input-handler-to-resume-task2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))

→ (tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-time-for-running-input-handler-to-resume-task2 (os))

= os-running-input-handler-to-resume-task2 (os))

Event: Disable trace-running-input-handler-to-resume-task2.

Definition: os-time-for-running-input-handler-to-resume-task3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-RESUME-TASK3
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH

(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                  (TM-IPORTS OS)))
'9
(PUTNTH '3231
 '10
 (PUTNTH
  (TM-R2 OS)
  '13
  (PUTNTH
   (TM-R3 OS)
   '14
   (PUTSEG
    (OS-NEW-TASK-TABLE OS)
    '15
    (PUTSEG
     (OS-SEGMENT-TABLE OS)
     '159
     (PUTSEG
      (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                 (OS-READYQ OS))
      '191
      (PUTSEG
          (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                            '0
                            '0
                            OS)
          '211
          (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                  '243
                  (PUTSEG (OS-CODE OS)
                          '2547
                          (PUTNTH '2558
                                  '3309
                                  (PUTNTH '3133
                                          '3310
                                          (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3231
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                (TM-IPORTS OS)))
'2

   (PUTNTH
    (PLUS '243
          (TIMES '8
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-resume-task3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-time-for-running-input-handler-to-resume-task3 (os))

= os-running-input-handler-to-resume-task3 (os))

Event: Disable trace-running-input-handler-to-resume-task3.

Definition: os-time-for-running-input-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-PATH1
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (OS-READYQ OS)))
           (OS-NEW-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (ARRAY-QFIRST (OS-READYQ OS))))
             (OS-NEW-TASK-TABLE OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9

     (PUTNTH '3231
      '10
      (PUTNTH
       (TM-R2 OS)
       '13
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      (OS-READYQ OS))
           '191
           (PUTSEG
               (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                 '0
                                 '0
                                 OS)
               '211
               (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
                       '243
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS)))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)

 (TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TM-IPORTS OS))
 (TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-lpsw1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-processor (os-running-input-handler-to-resume-task1 (os),

os-time-for-running-input-handler-to-lpsw (os))

= os-running-input-handler-path1 (os))

Event: Disable trace-running-input-handler-to-lpsw1.

(DEFN
OS-RUNNING-INPUT-HANDLER-PATH2
(OS)
(TM
 (PUTNTH
  (GETNTH (TIMES '9
                 (ARRAY-QFIRST (OS-READYQ OS)))
          (OS-NEW-TASK-TABLE OS))
  '0
  (PUTNTH
   (GETNTH (PLUS '1
                 (TIMES '9
                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '1
   (PUTNTH
    (GETNTH (PLUS '8
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '2
    (PUTNTH
     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))

    (PUTNTH
     (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                       (TM-IPORTS OS)))
     '9
     (PUTNTH '3231
      '10
      (PUTNTH
       (TM-R2 OS)
       '13
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      (OS-READYQ OS))
           '191
           (PUTSEG
               (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                 '0
                                 '0
                                 OS)
               '211
               (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
                       '243
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS)))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)

(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-lpsw2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-processor (os-running-input-handler-to-resume-task2 (os),

os-time-for-running-input-handler-to-lpsw (os))

= os-running-input-handler-path2 (os))

Event: Disable trace-running-input-handler-to-lpsw2.

(DEFN
OS-RUNNING-INPUT-HANDLER-PATH3
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (OS-READYQ OS)))
         (OS-NEW-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (OS-READYQ OS))))
          (OS-NEW-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8
                 (TIMES '9

             (ARRAY-QFIRST (OS-READYQ OS))))
(OS-NEW-TASK-TABLE OS))
'2
(PUTNTH
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
'8
(PUTNTH
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
            (TM-IPORTS OS)))
'9
(PUTNTH '3231
'10
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
           (OS-READYQ OS))
'191
(PUTSEG
    (OS-UPDATE-STATUS (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      '0
                      '0
                      OS)
    '211
    (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
            '243
            (PUTSEG (OS-CODE OS)
                    '2547
                    (PUTNTH '2558
                            '3309
                            (PUTNTH '3238
                                    '3310
                                    (TM-MEMORY OS)))))))))))))))))
(TM-REGS OS)

(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-lpsw3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-processor (os-running-input-handler-to-resume-task3 (os),

os-time-for-running-input-handler-to-lpsw (os))

= os-running-input-handler-path3 (os))

Event: Disable trace-running-input-handler-to-lpsw3.

Definition: os-running-input-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick)

Definition: os-running-input-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick tick

tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-time-for-running-input-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Theorem: rewrite-running-input-trace1 tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path1 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os)),

os-running-input-time1 (os))

Event: Disable rewrite-running-input-trace1.

Theorem: rewrite-running-input-trace2 tm-processor (os-running-input-handler-thru-save-state (os),

os-running-input-time1 (os))

= tm-processor (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test (os)),

os-running-input-time2 (os))

Event: Disable rewrite-running-input-trace2.

Theorem: rewrite-running-input-trace3 tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-running-input-time2 (os))

= tm-processor (tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-time-for-running-input-handler-to-resume-task1 (os)),

os-time-for-running-input-handler-to-lpsw (os))

Event: Disable rewrite-running-input-trace3.

Theorem: trace-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

         = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path1 (os))

= os-running-input-handler-path1 (os))

Event: Disable trace-running-input-handler-path1.

Definition: os-running-input-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-running-input-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Definition: os-time-for-running-input-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick)

Theorem: rewrite-running-input-trace4 tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path2 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os)),

os-running-input-time3 (os))

Event: Disable rewrite-running-input-trace4.

Theorem: rewrite-running-input-trace5 tm-processor (os-running-input-handler-thru-save-state (os),

os-running-input-time3 (os))

= tm-processor (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test (os)),

os-running-input-time4 (os))

Event: Disable rewrite-running-input-trace5.

Theorem: rewrite-running-input-trace6 tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-running-input-time4 (os))

= tm-processor (tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-time-for-running-input-handler-to-resume-task2 (os)),

os-time-for-running-input-handler-to-lpsw (os))

Event: Disable rewrite-running-input-trace6.

Theorem: trace-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path2 (os))

= os-running-input-handler-path2 (os))

Event: Disable trace-running-input-handler-path2.

Definition: os-running-input-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Definition: os-running-input-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-time-for-running-input-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Theorem: rewrite-running-input-trace7 tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path3 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os)),

os-running-input-time5 (os))

Event: Disable rewrite-running-input-trace7.

Theorem: rewrite-running-input-trace8 tm-processor (os-running-input-handler-thru-save-state (os),

os-running-input-time5 (os))

= tm-processor (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test (os)),

os-running-input-time6 (os))

Event: Disable rewrite-running-input-trace8.

Theorem: rewrite-running-input-trace9 tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-running-input-time6 (os))

= tm-processor (tm-processor (os-running-input-handler-to-ibuffer-full-test (os),

os-time-for-running-input-handler-to-resume-task3 (os)),

os-time-for-running-input-handler-to-lpsw (os))

Event: Disable rewrite-running-input-trace9.

Theorem: trace-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path3 (os))

= os-running-input-handler-path3 (os))

Event: Disable trace-running-input-handler-path3.

Definition: os-time-for-running-input-handler-to-ibuffer-full-test2 (os)

= '(tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-IBUFFER-FULL-TEST2
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)

(PUTNTH
(TM-SP OS)
'1
(PUTNTH
 (TM-PACK-PSW (TM-CC OS)
              (TM-ERROR OS)
              (TM-SVCFLAG OS)
              (TM-SVCID OS))
 '2
 (PUTNTH
  (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
  '8
  (PUTNTH
   (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                     (TM-IPORTS OS)))
   '9
   (PUTNTH '3231
    '10
    (PUTNTH
     (TM-R2 OS)
     '13
     (PUTNTH
      (TM-R3 OS)
      '14
      (PUTSEG
       (OS-NEW-TASK-TABLE OS)
       '15
       (PUTSEG
        (OS-SEGMENT-TABLE OS)
        '159
        (PUTSEG
         (OS-READYQ OS)
         '191
         (PUTSEG
             (OS-STATUS-TABLE OS)
             '211
             (PUTSEG (OS-IBUFFERS OS)
                     '243
                     (PUTSEG (OS-CODE OS)
                             '2547
                             (PUTNTH '2558
                                     '3309
                                     (PUTNTH '3063

                                               (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3091
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (GETNTH '2 (TM-REGS OS))
   '2
   (PUTNTH (GETNTH '3 (TM-REGS OS))
           '3
           (PUTNTH (PLUS '211
                         (TIMES '2
                                (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
                   '5
                   (TM-REGS OS))))))
(TM-CC-VALUE
 (TM-ALU-DIFFERENCE
                  (GETNTH (TIMES '2
                                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                          (OS-STATUS-TABLE OS))
                  '5))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-ibuffer-full-test2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

≠ '5))))

→ (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test2 (os))

= os-running-input-handler-to-ibuffer-full-test2 (os))

Event: Disable trace-running-input-handler-to-ibuffer-full-test2.

Definition: os-time-for-running-input-handler-to-resume-task4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-RESUME-TASK4
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3231
        '10
        (PUTNTH
         (TM-R2 OS)
         '13
         (PUTNTH
          (TM-R3 OS)
          '14
          (PUTSEG

(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
 (OS-SEGMENT-TABLE OS)
 '159
 (PUTSEG
  (OS-READYQ OS)
  '191
  (PUTSEG
      (OS-STATUS-TABLE OS)
      '211
      (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
              '243
              (PUTSEG (OS-CODE OS)
                      '2547
                      (PUTNTH '2558
                              '3309
                              (PUTNTH '3112
                                      '3310
                                      (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3231
'0
(PUTNTH '3310
'1
(PUTNTH
(PLUS '256
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                  (TM-IPORTS OS))))
'2
(PUTNTH
(PLUS '243
 (TIMES '8
        (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
'3
(PUTNTH
(PLUS '247
(PLUS
(TIMES '8
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
(DECR-MOD (GETNTH '1
                 (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TABLE '8 (OS-IBUFFERS OS))))
         '4)))
'4

     (PUTNTH (PLUS '211
                   (TIMES '2
                          (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
             '5
             (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-PLUS
  (PLUS '243
   (PLUS
        (TIMES '8
               (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
        (DECR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  '4)))
  '4))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-resume-task4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-time-for-running-input-handler-to-resume-task4 (os))

= os-running-input-handler-to-resume-task4 (os))

Event: Disable trace-running-input-handler-to-resume-task4.

Definition: os-time-for-running-input-handler-to-resume-task5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
   tick tick tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-RESUME-TASK5
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
 (TM-SP OS)
 '1
 (PUTNTH
  (TM-PACK-PSW (TM-CC OS)
               (TM-ERROR OS)
               (TM-SVCFLAG OS)
               (TM-SVCID OS))
  '2
  (PUTNTH
   (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
   '8
   (PUTNTH
    (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                      (TM-IPORTS OS)))
    '9
    (PUTNTH '3231
     '10
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (OS-READYQ OS)
          '191

(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
        '243
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558
                        '3309
                        (PUTNTH '3126
                                '3310
                                (TM-MEMORY OS)))))))))))))))))
(PUTNTH '3231
'0
(PUTNTH '3310
'1
(PUTNTH
(PLUS '256
(TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
            (TM-IPORTS OS))))
'2
(PUTNTH
(PLUS '243
(TIMES '8
  (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
'3
(PUTNTH
(PLUS '247
(PLUS (TIMES '8
          (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
   (GETNTH '1
           (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                   (TABLE '8 (OS-IBUFFERS OS))))))
'4
(PUTNTH (PLUS '211
     (TIMES '2
            (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
'5
(TM-REGS OS)))))))
(TM-CC-VALUE
(TM-ALU-INCR-MOD (GETNTH '1
           (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                   (TABLE '8 (OS-IBUFFERS OS))))
   (GETNTH '3

                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-resume-task5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))

→ (tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-time-for-running-input-handler-to-resume-task5 (os))

= os-running-input-handler-to-resume-task5 (os))

Event: Disable trace-running-input-handler-to-resume-task5.

Definition: os-time-for-running-input-handler-to-resume-task6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-INPUT-HANDLER-TO-RESUME-TASK6
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0
 (PUTNTH

(TM-SP OS)
'1
(PUTNTH
 (TM-PACK-PSW (TM-CC OS)
              (TM-ERROR OS)
              (TM-SVCFLAG OS)
              (TM-SVCID OS))
 '2
 (PUTNTH
  (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
  '8
  (PUTNTH
   (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                     (TM-IPORTS OS)))
   '9
   (PUTNTH '3231
    '10
    (PUTNTH
     (TM-R2 OS)
     '13
     (PUTNTH
      (TM-R3 OS)
      '14
      (PUTSEG
       (OS-NEW-TASK-TABLE OS)
       '15
       (PUTSEG
        (OS-SEGMENT-TABLE OS)
        '159
        (PUTSEG
         (OS-READYQ OS)
         '191
         (PUTSEG
             (OS-STATUS-TABLE OS)
             '211
             (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                     '243
                     (PUTSEG (OS-CODE OS)
                             '2547
                             (PUTNTH '2558
                                     '3309
                                     (PUTNTH '3133
                                             '3310
                                             (TM-MEMORY OS)))))))))))))))))

(PUTNTH '3231
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                     (TM-IPORTS OS)))
   '2
   (PUTNTH
    (PLUS '243
          (TIMES '8
                 (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
    '3
    (PUTNTH
      (PLUS '247
            (PLUS (TIMES '8
                         (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS)))
                  (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
      '4
      (PUTNTH (PLUS '211
                    (TIMES '2
                           (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
              '5
              (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD (GETNTH '1
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))
                  (GETNTH '3
                          (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                                  (TABLE '8 (OS-IBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))

 (TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-resume-task6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-time-for-running-input-handler-to-resume-task6 (os))

= os-running-input-handler-to-resume-task6 (os))

Event: Disable trace-running-input-handler-to-resume-task6.

(DEFN
OS-RUNNING-INPUT-HANDLER-PATH4
(OS)
(TM
 (PUTNTH
  (GETNTH (TIMES '9
                 (ARRAY-QFIRST (OS-READYQ OS)))
          (OS-NEW-TASK-TABLE OS))
  '0
  (PUTNTH
   (GETNTH (PLUS '1
                 (TIMES '9
                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '1
   (PUTNTH
    (GETNTH (PLUS '8
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '2
    (PUTNTH
     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
     '8
     (PUTNTH

     (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                       (TM-IPORTS OS)))
     '9
     (PUTNTH '3231
      '10
      (PUTNTH
       (TM-R2 OS)
       '13
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (OS-READYQ OS)
           '191
           (PUTSEG
               (OS-STATUS-TABLE OS)
               '211
               (PUTSEG (OS-IBUFFERS-WITH-QREPLACED-OVERFLOW-CHARACTER OS)
                       '243
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS)))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))

                           (TM-IPORTS OS))
 (TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-lpsw4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-running-input-handler-to-resume-task4 (os),

os-time-for-running-input-handler-to-lpsw (os))

= os-running-input-handler-path4 (os))

Event: Disable trace-running-input-handler-to-lpsw4.

(DEFN
OS-RUNNING-INPUT-HANDLER-PATH5
(OS)
(TM
 (PUTNTH
  (GETNTH (TIMES '9
                 (ARRAY-QFIRST (OS-READYQ OS)))
          (OS-NEW-TASK-TABLE OS))
  '0
  (PUTNTH
   (GETNTH (PLUS '1
                 (TIMES '9
                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '1
   (PUTNTH
    (GETNTH (PLUS '8
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '2
    (PUTNTH
     (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
     '8
     (PUTNTH
      (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                        (TM-IPORTS OS)))
      '9
      (PUTNTH '3231

      (PUTNTH
       (TM-R2 OS)
       '13
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (OS-READYQ OS)
           '191
           (PUTSEG
               (OS-STATUS-TABLE OS)
               '211
               (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-OVERFLOW-CHARACTER OS)
                       '243
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS)))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-lpsw5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-running-input-handler-to-resume-task5 (os),

os-time-for-running-input-handler-to-lpsw (os))

= os-running-input-handler-path5 (os))

Event: Disable trace-running-input-handler-to-lpsw5.

(DEFN
 OS-RUNNING-INPUT-HANDLER-PATH6
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (OS-READYQ OS)))
           (OS-NEW-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9
                          (ARRAY-QFIRST (OS-READYQ OS))))
             (OS-NEW-TASK-TABLE OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
      '8
      (PUTNTH
       (TM-ICHAR (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                         (TM-IPORTS OS)))
       '9
       (PUTNTH '3231
        '10
        (PUTNTH
         (TM-R2 OS)
         '13

       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-NEW-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (OS-READYQ OS)
           '191
           (PUTSEG
               (OS-STATUS-TABLE OS)
               '211
               (PUTSEG (OS-IBUFFERS-WITH-ENQUEUED-CHARACTER OS)
                       '243
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS)))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-CLEAR-INPUT-INTERRUPT (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TM-IPORTS OS))
(TM-OPORTS OS))
NIL)

Theorem: trace-running-input-handler-to-lpsw6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-running-input-handler-to-resume-task6 (os),

os-time-for-running-input-handler-to-lpsw (os))

= os-running-input-handler-path6 (os))

Event: Disable trace-running-input-handler-to-lpsw6.

Definition: os-running-input-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick)

Definition: os-running-input-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-time-for-running-input-handler-path4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Theorem: rewrite-running-input-trace10 tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path4 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os)),

os-running-input-time7 (os))

Event: Disable rewrite-running-input-trace10.

Theorem: rewrite-running-input-trace11 tm-processor (os-running-input-handler-thru-save-state (os),

os-running-input-time7 (os))

= tm-processor (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test2 (os)),

os-running-input-time8 (os))

Event: Disable rewrite-running-input-trace11.

Theorem: rewrite-running-input-trace12 tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-running-input-time8 (os))

= tm-processor (tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-time-for-running-input-handler-to-resume-task4 (os)),

os-time-for-running-input-handler-to-lpsw (os))

Event: Disable rewrite-running-input-trace12.

Theorem: trace-running-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path4 (os))

= os-running-input-handler-path4 (os))

Event: Disable trace-running-input-handler-path4.

Definition: os-running-input-time9 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

Definition: os-running-input-time10 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Definition: os-time-for-running-input-handler-path5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Theorem: rewrite-running-input-trace13 tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path5 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os)),

os-running-input-time9 (os))

Event: Disable rewrite-running-input-trace13.

Theorem: rewrite-running-input-trace14 tm-processor (os-running-input-handler-thru-save-state (os),

os-running-input-time9 (os))

= tm-processor (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test2 (os)),

os-running-input-time10 (os))

Event: Disable rewrite-running-input-trace14.

Theorem: rewrite-running-input-trace15 tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-running-input-time10 (os))

= tm-processor (tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-time-for-running-input-handler-to-resume-task5 (os)),

os-time-for-running-input-handler-to-lpsw (os))

Event: Disable rewrite-running-input-trace15.

Theorem: trace-running-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

         ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path5 (os))

= os-running-input-handler-path5 (os))

Event: Disable trace-running-input-handler-path5.

Definition: os-running-input-time11 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Definition: os-running-input-time12 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-time-for-running-input-handler-path6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick

     tick tick tick tick tick tick tick tick tick tick
     tick tick tick tick tick tick)

Theorem: rewrite-running-input-trace16 tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path6 (os))

= tm-processor (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-thru-save-state (os)),

os-running-input-time11 (os))

Event: Disable rewrite-running-input-trace16.

Theorem: rewrite-running-input-trace17 tm-processor (os-running-input-handler-thru-save-state (os),

os-running-input-time11 (os))

= tm-processor (tm-processor (os-running-input-handler-thru-save-state (os),

os-time-for-running-input-handler-to-ibuffer-full-test2 (os)),

os-running-input-time12 (os))

Event: Disable rewrite-running-input-trace17.

Theorem: rewrite-running-input-trace18 tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-running-input-time12 (os))

= tm-processor (tm-processor (os-running-input-handler-to-ibuffer-full-test2 (os),

os-time-for-running-input-handler-to-resume-task6 (os)),

os-time-for-running-input-handler-to-lpsw (os))

Event: Disable rewrite-running-input-trace18.

Theorem: trace-running-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler-path6 (os))

= os-running-input-handler-path6 (os))

Event: Disable trace-running-input-handler-path6.

Definition: os-time-for-running-input-handler (os) = if getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

  = '5

then if array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-time-for-running-input-handler-path1 (os)

elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))

then os-time-for-running-input-handler-path2 (os) else os-time-for-running-input-handler-path3 (os) endif

elseif array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-time-for-running-input-handler-path4 (os) elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

then os-time-for-running-input-handler-path5 (os) else os-time-for-running-input-handler-path6 (os) endif

Definition: os-running-input-handler (os) = if getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

  = '5

then if array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-running-input-handler-path1 (os)

elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))

then os-running-input-handler-path2 (os) else os-running-input-handler-path3 (os) endif

elseif array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os))

then os-running-input-handler-path4 (os) elseif tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

then os-running-input-handler-path5 (os) else os-running-input-handler-path6 (os) endif Theorem: trace-running-input-handler (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-intended-input-interrupt (os),

os-time-for-running-input-handler (os))

= os-running-input-handler (os))

Event: Disable trace-running-input-handler.

Definition: os-intended-output-interrupt (tm) = tm-set-memory (putnth (tm-pc (tm),

                        '0,

putnth (tm-sp (tm),

                               '1,

putnth (tm-pack-psw (tm-cc (tm), tm-error (tm), tm-svcflag (tm), tm-svcid (tm)),

                                     '2,

putnth (tm-interrupting-output-port (tm-oports (tm)),

                                            '9,

putseg (os-task-table (tm),

                                                   '15,

putseg (os-segment-table (tm),

                                                         '159,

putseg (os-readyq (tm),

                                                                '191,

putseg (os-status-table (tm),

                                                                      '211,

putseg (os-obuffers (tm),

                                                                             '371,

putseg (os-code (tm),

                                                                                   '2547,

tm-memory (tm))))))))))),

tm-set-pc ('3135,

tm-set-sp ('3310,

tm-set-svmode ('1,

tm-set-error ('0,

tm-set-rwstate ('0,

tm-set-oports (tm-clear-output-interrupt (tm-interrupting-output-port (tm-oports (tm)),

tm-oports (tm)),

tm)))))))

Theorem: equivalence-of-output-interrupt-expressions good-os (os) → (tm-execute-output-interrupt (os) = os-intended-output-interrupt (os))

Event: Disable equivalence-of-output-interrupt-expressions.

Definition: os-time-for-waiting-output-handler-thru-readyq-empty-test (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-THRU-READYQ-EMPTY-TEST
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-TASK-TABLE OS)
         '15
         (PUTSEG
            (OS-SEGMENT-TABLE OS)
            '159
            (PUTSEG (OS-READYQ OS)
                    '191
                    (PUTSEG (OS-STATUS-TABLE OS)

                          (PUTSEG (OS-OBUFFERS OS)
                                  '371
                                  (PUTSEG (OS-CODE OS)
                                          '2547
                                          (PUTNTH '3146
                                                  '3310
                                                  (TM-MEMORY OS))))))))))))))
(PUTNTH '3156
        '0
        (PUTNTH '3310
                '1
                (PUTNTH '191 '3 (TM-REGS OS))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-thru-readyq-empty-test (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-thru-readyq-empty-test (os))

= os-waiting-output-handler-thru-readyq-empty-test (os))

Event: Disable trace-waiting-output-handler-thru-readyq-empty-test.

Definition: os-time-for-waiting-output-handler-to-obuffer-empty-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-TO-OBUFFER-EMPTY-TEST
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
 (TM-SP OS)
 '1
 (PUTNTH
  (TM-PACK-PSW (TM-CC OS)
               (TM-ERROR OS)
               (TM-SVCFLAG OS)
               (TM-SVCID OS))
  '2
  (PUTNTH
   (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
   '9
   (PUTNTH '3206
    '10
    (PUTNTH
     (TM-R3 OS)
     '14
     (PUTSEG
      (OS-TASK-TABLE OS)
      '15
      (PUTSEG
       (OS-SEGMENT-TABLE OS)
       '159
       (PUTSEG
        (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                   (OS-READYQ OS))
        '191
        (PUTSEG
              (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                '0
                                '0
                                OS)
              '211
              (PUTSEG (OS-OBUFFERS OS)
                      '371
                      (PUTSEG (OS-CODE OS)
                              '2547
                              (PUTNTH '3178

                                       (TM-MEMORY OS))))))))))))))
(PUTNTH '3184
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
   '2
   (PUTNTH '191
    '3
    (PUTNTH
          (PLUS '195
                (GETNTH '1 (OS-READYQ OS)))
          '4
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1 (OS-READYQ OS))
                              '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-obuffer-empty-test (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-time-for-waiting-output-handler-to-obuffer-empty-test (os))

= os-waiting-output-handler-to-obuffer-empty-test (os))

Event: Disable trace-waiting-output-handler-to-obuffer-empty-test.

Definition: os-time-for-waiting-output-handler-to-dispatcher1 (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-TO-DISPATCHER1
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-TASK-TABLE OS)
         '15
         (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG
           (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                      (OS-READYQ OS))

         (PUTSEG
               (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 '0
                                 '0
                                 OS)
               '211
               (PUTSEG (OS-OBUFFERS OS)
                       '371
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '3195
                                       '3310
                                       (TM-MEMORY OS))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
   '2
   (PUTNTH
    (PLUS '371
          (TIMES '8
                 (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
    '3
    (PUTNTH
          (PLUS '195
                (GETNTH '1 (OS-READYQ OS)))
          '4
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0

  (TM-CLOCK OS)
  (TM-IPORTS OS)
  (TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                             (TM-OPORTS OS)))
 NIL)

Theorem: trace-waiting-output-handler-to-dispatcher1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-processor (os-waiting-output-handler-to-obuffer-empty-test (os),

os-time-for-waiting-output-handler-to-dispatcher1 (os))

= os-waiting-output-handler-to-dispatcher1 (os))

Event: Disable trace-waiting-output-handler-to-dispatcher1.

Definition: os-time-for-waiting-output-handler-to-dispatcher2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-TO-DISPATCHER2
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206

(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
 (OS-TASK-TABLE OS)
 '15
 (PUTSEG
  (OS-SEGMENT-TABLE OS)
  '159
  (PUTSEG
   (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
              (OS-READYQ OS))
   '191
   (PUTSEG
         (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           '0
                           '0
                           OS)
         '211
         (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                 '371
                 (PUTSEG (OS-CODE OS)
                         '2547
                         (PUTNTH '3204
                                 '3310
                                 (TM-MEMORY OS))))))))))))))
(PUTNTH '3206
'0
(PUTNTH '3310
'1
(PUTNTH
(ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                   (TABLE '8 (OS-OBUFFERS OS))))
'2
(PUTNTH
(PLUS '371
    (TIMES '8
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
'3
(PUTNTH
    (PLUS '195
          (GETNTH '1 (OS-READYQ OS)))
    '4

          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD
                 (GETNTH '0
                         (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
                 (GETNTH '3
                         (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-START-OUTPUT
           (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-dispatcher2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-waiting-output-handler-to-obuffer-empty-test (os),

os-time-for-waiting-output-handler-to-dispatcher2 (os))

= os-waiting-output-handler-to-dispatcher2 (os))

Event: Disable trace-waiting-output-handler-to-dispatcher2.

Definition: os-time-for-waiting-output-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-PATH1
(OS)
(TM
(PUTNTH
(GETNTH (TIMES '9
            (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS)))
     (OS-TASK-TABLE OS))
'0
(PUTNTH
(GETNTH (PLUS '1
            (TIMES '9
                   (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
      (OS-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
             (TIMES '9
                    (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
       (OS-TASK-TABLE OS))
'2
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'9
(PUTNTH '3206
 '10
 (PUTNTH
  (TM-R3 OS)
  '14
  (PUTSEG
   (OS-TASK-TABLE OS)
   '15
   (PUTSEG
    (OS-SEGMENT-TABLE OS)
    '159
    (PUTSEG
     (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                (OS-READYQ OS))

(PUTSEG
(OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
  '0
  '0
  OS)
'211
(PUTSEG (OS-OBUFFERS OS)
'371
(PUTSEG (OS-CODE OS)
'2547
(PUTNTH '3217
        '3310
        (TM-MEMORY OS))))))))))))))
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS))))
(REMAINDER
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS))
'4)
(QUOTIENT
(REMAINDER
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS))
'256)
'4)
(QUOTIENT
(REMAINDER
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS))
'512)
'256)
(QUOTIENT (GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS))

(BASE (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
              (TABLE '2 (OS-SEGMENT-TABLE OS))))
(LIMIT (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
               (TABLE '2 (OS-SEGMENT-TABLE OS))))
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-lpsw1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-output-handler-to-dispatcher1 (os),

os-time-for-waiting-output-handler-to-lpsw (os))

= os-waiting-output-handler-path1 (os))

Event: Disable trace-waiting-output-handler-to-lpsw1.

(DEFN
OS-WAITING-OUTPUT-HANDLER-PATH2
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS)))
         (OS-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
          (OS-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8
                 (TIMES '9
                        (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))

   (OS-TASK-TABLE OS))
'2
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'9
(PUTNTH '3206
'10
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
 (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
            (OS-READYQ OS))
 '191
 (PUTSEG
       (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                         '0
                         '0
                         OS)
       '211
       (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
               '371
               (PUTSEG (OS-CODE OS)
                       '2547
                       (PUTNTH '3217
                               '3310
                               (TM-MEMORY OS))))))))))))))
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
        (TABLE '9 (OS-TASK-TABLE OS))))
(REMAINDER
  (GETNTH (PLUS '8
                (TIMES '9
                       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
          (OS-TASK-TABLE OS))
  '4)
(QUOTIENT

 (REMAINDER
          (GETNTH (PLUS '8
                        (TIMES '9
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  (OS-TASK-TABLE OS))
          '256)
 '4)
(QUOTIENT
 (REMAINDER
          (GETNTH (PLUS '8
                        (TIMES '9
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  (OS-TASK-TABLE OS))
          '512)
 '256)
(QUOTIENT (GETNTH (PLUS '8
                        (TIMES '9
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  (OS-TASK-TABLE OS))
          '512)
(BASE (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
              (TABLE '2 (OS-SEGMENT-TABLE OS))))
(LIMIT (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
               (TABLE '2 (OS-SEGMENT-TABLE OS))))
(TM-SLIMIT OS)
'0
'0
'1000
(TM-IPORTS OS)
(TM-START-OUTPUT
           (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-lpsw2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-output-handler-to-dispatcher2 (os),

os-time-for-waiting-output-handler-to-lpsw (os))

= os-waiting-output-handler-path2 (os))

Event: Disable trace-waiting-output-handler-to-lpsw2.

Definition: os-time-for-waiting-output-handler-to-obuffer-empty-test2 (os)

= '(tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-TO-OBUFFER-EMPTY-TEST2
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-TASK-TABLE OS)
         '15
         (PUTSEG
            (OS-SEGMENT-TABLE OS)
            '159
            (PUTSEG (OS-READYQ OS)
                    '191
                    (PUTSEG (OS-STATUS-TABLE OS)
                            '211
                            (PUTSEG (OS-OBUFFERS OS)
                                    '371
                                    (PUTSEG (OS-CODE OS)
                                            '2547
                                            (PUTNTH '3146

                                                  (TM-MEMORY OS))))))))))))))
(PUTNTH '3184
 '0
 (PUTNTH '3310
  '1
  (PUTNTH '191
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))
(TM-CC-VALUE
 (TM-ALU-DIFFERENCE
                 (GETNTH (TIMES '2
                                (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS)))
                         (OS-STATUS-TABLE OS))
                 '4))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-obuffer-empty-test2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

≠ '4))))

→ (tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-time-for-waiting-output-handler-to-obuffer-empty-test2 (os))

= os-waiting-output-handler-to-obuffer-empty-test2 (os))

Event: Disable trace-waiting-output-handler-to-obuffer-empty-test2.

Definition: os-time-for-waiting-output-handler-to-dispatcher3 (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-TO-DISPATCHER3
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-TASK-TABLE OS)
         '15
         (PUTSEG
            (OS-SEGMENT-TABLE OS)
            '159
            (PUTSEG (OS-READYQ OS)
                    '191
                    (PUTSEG (OS-STATUS-TABLE OS)
                            '211
                            (PUTSEG (OS-OBUFFERS OS)
                                    '371
                                    (PUTSEG (OS-CODE OS)

                                          (PUTNTH '3195
                                                  '3310
                                                  (TM-MEMORY OS))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
  '1
  (PUTNTH (PLUS '371
                (TIMES '8
                       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-dispatcher3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-processor (os-waiting-output-handler-to-obuffer-empty-test2 (os),

os-time-for-waiting-output-handler-to-dispatcher3 (os))

= os-waiting-output-handler-to-dispatcher3 (os))

Event: Disable trace-waiting-output-handler-to-dispatcher3.

Definition: os-time-for-waiting-output-handler-to-dispatcher4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-TO-DISPATCHER4
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG
         (OS-TASK-TABLE OS)
         '15
         (PUTSEG
            (OS-SEGMENT-TABLE OS)
            '159
            (PUTSEG (OS-READYQ OS)
                    '191
                    (PUTSEG (OS-STATUS-TABLE OS)
                            '211
                            (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                                    '371
                                    (PUTSEG (OS-CODE OS)
                                            '2547

                                          (PUTNTH '3204
                                                  '3310
                                                  (TM-MEMORY OS))))))))))))))
(PUTNTH '3206
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                         (TABLE '8 (OS-OBUFFERS OS))))
   '2
   (PUTNTH
          (PLUS '371
                (TIMES '8
                       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD
                 (GETNTH '0
                         (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
                 (GETNTH '3
                         (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-START-OUTPUT
           (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (TM-OPORTS OS)))

 NIL)

Theorem: trace-waiting-output-handler-to-dispatcher4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-waiting-output-handler-to-obuffer-empty-test2 (os),

os-time-for-waiting-output-handler-to-dispatcher4 (os))

= os-waiting-output-handler-to-dispatcher4 (os))

Event: Disable trace-waiting-output-handler-to-dispatcher4.

Definition: os-time-for-waiting-output-handler-to-wait (os)

= '(tick tick tick tick tick tick)

(DEFN OS-WAITING-OUTPUT-HANDLER-PATH3
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3206
       '10
       (PUTNTH
        (TM-R3 OS)
        '14
        (PUTSEG

       (OS-TASK-TABLE OS)
       '15
       (PUTSEG
          (OS-SEGMENT-TABLE OS)
          '159
          (PUTSEG (OS-READYQ OS)
                  '191
                  (PUTSEG (OS-STATUS-TABLE OS)
                          '211
                          (PUTSEG (OS-OBUFFERS OS)
                                  '371
                                  (PUTSEG (OS-CODE OS)
                                          '2547
                                          (PUTNTH '3211
                                                  '3310
                                                  (TM-MEMORY OS))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
  '1
  (PUTNTH '191
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-wait1 (good-os (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-output-handler-to-dispatcher3 (os),

os-time-for-waiting-output-handler-to-wait (os))

= os-waiting-output-handler-path3 (os))

Event: Disable trace-waiting-output-handler-to-wait1.

(DEFN
OS-WAITING-OUTPUT-HANDLER-PATH4
(OS)
(TM
 (PUTNTH
  (TM-PC OS)
  '0
  (PUTNTH
   (TM-SP OS)
   '1
   (PUTNTH
    (TM-PACK-PSW (TM-CC OS)
                 (TM-ERROR OS)
                 (TM-SVCFLAG OS)
                 (TM-SVCID OS))
    '2
    (PUTNTH
     (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
     '9
     (PUTNTH '3206
      '10
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-TASK-TABLE OS)
        '15
        (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG (OS-READYQ OS)
                   '191
                   (PUTSEG (OS-STATUS-TABLE OS)
                           '211
                           (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)

                                  (PUTSEG (OS-CODE OS)
                                          '2547
                                          (PUTNTH '3211
                                                  '3310
                                                  (TM-MEMORY OS))))))))))))))
(PUTNTH '3222
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                         (TABLE '8 (OS-OBUFFERS OS))))
   '2
   (PUTNTH '191
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'1
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-START-OUTPUT
           (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (TM-OPORTS OS)))
NIL)

Theorem: trace-waiting-output-handler-to-wait2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (tm-processor (os-waiting-output-handler-to-dispatcher4 (os),

os-time-for-waiting-output-handler-to-wait (os))

= os-waiting-output-handler-path4 (os))

Event: Disable trace-waiting-output-handler-to-wait2.

Definition: os-waiting-output-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-waiting-output-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick)

Definition: os-time-for-waiting-output-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Theorem: rewrite-waiting-output-trace1 tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path1 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-thru-readyq-empty-test (os)),

os-waiting-output-time1 (os))

Event: Disable rewrite-waiting-output-trace1.

Theorem: rewrite-waiting-output-trace2 tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-waiting-output-time1 (os))

= tm-processor (tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-time-for-waiting-output-handler-to-obuffer-empty-test (os)),

os-waiting-output-time2 (os))

Event: Disable rewrite-waiting-output-trace2.

Theorem: rewrite-waiting-output-trace3 tm-processor (os-waiting-output-handler-to-obuffer-empty-test (os),

os-waiting-output-time2 (os))

= tm-processor (tm-processor (os-waiting-output-handler-to-obuffer-empty-test (os),

os-time-for-waiting-output-handler-to-dispatcher1 (os)),

os-time-for-waiting-output-handler-to-lpsw (os))

Event: Disable rewrite-waiting-output-trace3.

Theorem: trace-waiting-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path1 (os))

= os-waiting-output-handler-path1 (os))

Event: Disable trace-waiting-output-handler-path1.

Definition: os-waiting-output-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

Definition: os-waiting-output-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick

      tick tick tick tick tick tick tick tick tick tick
      tick tick)

Definition: os-time-for-waiting-output-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick)

Theorem: rewrite-waiting-output-trace4 tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path2 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-thru-readyq-empty-test (os)),

os-waiting-output-time3 (os))

Event: Disable rewrite-waiting-output-trace4.

Theorem: rewrite-waiting-output-trace5 tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-waiting-output-time3 (os))

= tm-processor (tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-time-for-waiting-output-handler-to-obuffer-empty-test (os)),

os-waiting-output-time4 (os))

Event: Disable rewrite-waiting-output-trace5.

Theorem: rewrite-waiting-output-trace6 tm-processor (os-waiting-output-handler-to-obuffer-empty-test (os),

os-waiting-output-time4 (os))

= tm-processor (tm-processor (os-waiting-output-handler-to-obuffer-empty-test (os),

os-time-for-waiting-output-handler-to-dispatcher2 (os)),

os-time-for-waiting-output-handler-to-lpsw (os))

Event: Disable rewrite-waiting-output-trace6.

Theorem: trace-waiting-output-handler-path2 (good-os (os)

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path2 (os))

= os-waiting-output-handler-path2 (os))

Event: Disable trace-waiting-output-handler-path2.

Definition: os-waiting-output-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

Definition: os-waiting-output-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick)

Definition: os-time-for-waiting-output-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

Theorem: rewrite-waiting-output-trace7 tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path3 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-thru-readyq-empty-test (os)),

os-waiting-output-time5 (os))

Event: Disable rewrite-waiting-output-trace7.

Theorem: rewrite-waiting-output-trace8 tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-waiting-output-time5 (os))

= tm-processor (tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-time-for-waiting-output-handler-to-obuffer-empty-test2 (os)),

os-waiting-output-time6 (os))

Event: Disable rewrite-waiting-output-trace8.

Theorem: rewrite-waiting-output-trace9 tm-processor (os-waiting-output-handler-to-obuffer-empty-test2 (os),

os-waiting-output-time6 (os))

= tm-processor (tm-processor (os-waiting-output-handler-to-obuffer-empty-test2 (os),

os-time-for-waiting-output-handler-to-dispatcher3 (os)),

os-time-for-waiting-output-handler-to-wait (os))

Event: Disable rewrite-waiting-output-trace9.

Theorem: trace-waiting-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path3 (os))

= os-waiting-output-handler-path3 (os))

Event: Disable trace-waiting-output-handler-path3.

Definition: os-waiting-output-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick)

Definition: os-waiting-output-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

Definition: os-time-for-waiting-output-handler-path4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick

     tick tick tick tick tick tick tick tick tick tick
     tick tick tick tick tick tick tick)

Theorem: rewrite-waiting-output-trace10 tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path4 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-thru-readyq-empty-test (os)),

os-waiting-output-time7 (os))

Event: Disable rewrite-waiting-output-trace10.

Theorem: rewrite-waiting-output-trace11 tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-waiting-output-time7 (os))

= tm-processor (tm-processor (os-waiting-output-handler-thru-readyq-empty-test (os),

os-time-for-waiting-output-handler-to-obuffer-empty-test2 (os)),

os-waiting-output-time8 (os))

Event: Disable rewrite-waiting-output-trace11.

Theorem: rewrite-waiting-output-trace12 tm-processor (os-waiting-output-handler-to-obuffer-empty-test2 (os),

os-waiting-output-time8 (os))

= tm-processor (tm-processor (os-waiting-output-handler-to-obuffer-empty-test2 (os),

os-time-for-waiting-output-handler-to-dispatcher4 (os)),

os-time-for-waiting-output-handler-to-wait (os))

Event: Disable rewrite-waiting-output-trace12.

Theorem: trace-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler-path4 (os))

= os-waiting-output-handler-path4 (os))

Event: Disable trace-waiting-output-handler-path4.

Definition: os-time-for-waiting-output-handler (os) = if getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os))

      = '4

then if array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-time-for-waiting-output-handler-path1 (os) else os-time-for-waiting-output-handler-path2 (os) endif

elseif array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-time-for-waiting-output-handler-path3 (os) else os-time-for-waiting-output-handler-path4 (os) endif

Definition: os-waiting-output-handler (os) = if getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os))

      = '4

then if array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-waiting-output-handler-path1 (os) else os-waiting-output-handler-path2 (os) endif

elseif array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-waiting-output-handler-path3 (os) else os-waiting-output-handler-path4 (os) endif

Theorem: trace-waiting-output-handler (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (tm-processor (os-intended-output-interrupt (os),

os-time-for-waiting-output-handler (os))

= os-waiting-output-handler (os))

Event: Disable trace-waiting-output-handler.

Definition: os-time-for-running-output-handler-thru-save-state (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick

tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-THRU-SAVE-STATE
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
(TM-SP OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'9
(PUTNTH '3231
'10
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-OBUFFERS OS)
        '371

                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3156
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3156
        '0
        (PUTNTH '3310
                '1
                (PUTNTH (GETNTH '2 (TM-REGS OS))
                        '2
                        (PUTNTH (GETNTH '3 (TM-REGS OS))
                                '3
                                (TM-REGS OS)))))
(TM-CC-VALUE (TM-ALU-PLUS (PLUS '15
                                (TIMES '9
                                       (ARRAY-QFIRST (OS-READYQ OS))))
                          '8))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-thru-save-state (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-thru-save-state (os))

= os-running-output-handler-thru-save-state (os))

Event: Disable trace-running-output-handler-thru-save-state.

Definition: os-time-for-running-output-handler-to-obuffer-empty-test (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-TO-OBUFFER-EMPTY-TEST
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3231
       '10
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-NEW-TASK-TABLE OS)
          '15
          (PUTSEG
           (OS-SEGMENT-TABLE OS)
           '159
           (PUTSEG
            (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                       (OS-READYQ OS))
            '191
            (PUTSEG
                 (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))

                                 '0
                                 OS)
               '211
               (PUTSEG (OS-OBUFFERS OS)
                       '371
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3178
                                               '3310
                                               (TM-MEMORY OS))))))))))))))))
(PUTNTH '3184
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
   '2
   (PUTNTH '191
    '3
    (PUTNTH
          (PLUS '195
                (GETNTH '1 (OS-READYQ OS)))
          '4
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))))
(TM-CC-VALUE (TM-ALU-INCR-MOD (GETNTH '1 (OS-READYQ OS))
                              '16))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))

                             (TM-OPORTS OS)))
 NIL)

Theorem: trace-running-output-handler-to-obuffer-empty-test (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (tm-processor (os-running-output-handler-thru-save-state (os),

os-time-for-running-output-handler-to-obuffer-empty-test (os))

= os-running-output-handler-to-obuffer-empty-test (os))

Event: Disable trace-running-output-handler-to-obuffer-empty-test.

Definition: os-time-for-running-output-handler-to-resume-task1 (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-TO-RESUME-TASK1
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3231
       '10
       (PUTNTH

(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (OS-READYQ OS))
'191
(PUTSEG
     (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                       '0
                       '0
                       OS)
     '211
     (PUTSEG (OS-OBUFFERS OS)
             '371
             (PUTSEG (OS-CODE OS)
                     '2547
                     (PUTNTH '2558
                             '3309
                             (PUTNTH '3195
                                     '3310
                                     (TM-MEMORY OS))))))))))))))))
(PUTNTH '3231
'0
(PUTNTH '3310
'1
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'2
(PUTNTH
(PLUS '371
(TIMES '8
       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
'3
(PUTNTH
(PLUS '195

                (GETNTH '1 (OS-READYQ OS)))
          '4
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-resume-task1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os))

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-processor (os-running-output-handler-to-obuffer-empty-test (os),

os-time-for-running-output-handler-to-resume-task1 (os))

= os-running-output-handler-to-resume-task1 (os))

Event: Disable trace-running-output-handler-to-resume-task1.

Definition: os-time-for-running-output-handler-to-resume-task2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
    tick tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-TO-RESUME-TASK2
(OS)
(TM

(PUTNTH
(TM-PC OS)
'0
(PUTNTH
 (TM-SP OS)
 '1
 (PUTNTH
  (TM-PACK-PSW (TM-CC OS)
               (TM-ERROR OS)
               (TM-SVCFLAG OS)
               (TM-SVCID OS))
  '2
  (PUTNTH
   (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
   '9
   (PUTNTH '3231
    '10
    (PUTNTH
     (TM-R2 OS)
     '13
     (PUTNTH
      (TM-R3 OS)
      '14
      (PUTSEG
       (OS-NEW-TASK-TABLE OS)
       '15
       (PUTSEG
        (OS-SEGMENT-TABLE OS)
        '159
        (PUTSEG
         (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                    (OS-READYQ OS))
         '191
         (PUTSEG
              (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                '0
                                '0
                                OS)
              '211
              (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                      '371
                      (PUTSEG (OS-CODE OS)
                              '2547
                              (PUTNTH '2558

                                       (PUTNTH '3204
                                               '3310
                                               (TM-MEMORY OS))))))))))))))))
(PUTNTH '3231
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                         (TABLE '8 (OS-OBUFFERS OS))))
   '2
   (PUTNTH
    (PLUS '371
          (TIMES '8
                 (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
    '3
    (PUTNTH
          (PLUS '195
                (GETNTH '1 (OS-READYQ OS)))
          '4
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS)))))))
(TM-CC-VALUE
 (TM-ALU-INCR-MOD
                 (GETNTH '0
                         (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
                 (GETNTH '3
                         (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)

  (TM-START-OUTPUT
             (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                   (TABLE '8 (OS-OBUFFERS OS))))
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
             (TM-OPORTS OS)))
 NIL)

Theorem: trace-running-output-handler-to-resume-task2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-running-output-handler-to-obuffer-empty-test (os),

os-time-for-running-output-handler-to-resume-task2 (os))

= os-running-output-handler-to-resume-task2 (os))

Event: Disable trace-running-output-handler-to-resume-task2.

Definition: os-time-for-running-output-handler-to-lpsw (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-PATH1
 (OS)
 (TM
  (PUTNTH
   (GETNTH (TIMES '9
                  (ARRAY-QFIRST (OS-READYQ OS)))
           (OS-NEW-TASK-TABLE OS))
   '0
   (PUTNTH
    (GETNTH (PLUS '1
                  (TIMES '9
                         (ARRAY-QFIRST (OS-READYQ OS))))
            (OS-NEW-TASK-TABLE OS))
    '1
    (PUTNTH
     (GETNTH (PLUS '8
                   (TIMES '9

                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '2
   (PUTNTH
    (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
    '9
    (PUTNTH '3231
     '10
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                     (OS-READYQ OS))
          '191
          (PUTSEG
               (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 '0
                                 '0
                                 OS)
               '211
               (PUTSEG (OS-OBUFFERS OS)
                       '371
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)

(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-lpsw1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (tm-processor (os-running-output-handler-to-resume-task1 (os),

os-time-for-running-output-handler-to-lpsw (os))

= os-running-output-handler-path1 (os))

Event: Disable trace-running-output-handler-to-lpsw1.

(DEFN
OS-RUNNING-OUTPUT-HANDLER-PATH2
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (OS-READYQ OS)))
         (OS-NEW-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (OS-READYQ OS))))
          (OS-NEW-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8

                 (TIMES '9
                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '2
   (PUTNTH
    (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
    '9
    (PUTNTH '3231
     '10
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (ARRAY-ENQ (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                     (OS-READYQ OS))
          '191
          (PUTSEG
               (OS-UPDATE-STATUS (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 '0
                                 '0
                                 OS)
               '211
               (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                       '371
                       (PUTSEG (OS-CODE OS)
                               '2547
                               (PUTNTH '2558
                                       '3309
                                       (PUTNTH '3238
                                               '3310
                                               (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)

(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-START-OUTPUT
           (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-lpsw2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (tm-processor (os-running-output-handler-to-resume-task2 (os),

os-time-for-running-output-handler-to-lpsw (os))

= os-running-output-handler-path2 (os))

Event: Disable trace-running-output-handler-to-lpsw2.

Definition: os-time-for-running-output-handler-to-obuffer-empty-test2 (os)

= '(tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-TO-OBUFFER-EMPTY-TEST2
(OS)
(TM
(PUTNTH
 (TM-PC OS)
 '0
 (PUTNTH
  (TM-SP OS)
  '1

(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'9
(PUTNTH '3231
'10
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-OBUFFERS OS)
        '371
        (PUTSEG (OS-CODE OS)
                '2547
                (PUTNTH '2558
                        '3309
                        (PUTNTH '3156
                                '3310
                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3184
'0
(PUTNTH '3310
'1
(PUTNTH
(GETNTH '2 (TM-REGS OS))

   (PUTNTH
          (GETNTH '3 (TM-REGS OS))
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS))))))
(TM-CC-VALUE
 (TM-ALU-DIFFERENCE
                 (GETNTH (TIMES '2
                                (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS)))
                         (OS-STATUS-TABLE OS))
                 '4))
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-obuffer-empty-test2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

≠ '4))))

→ (tm-processor (os-running-output-handler-thru-save-state (os),

os-time-for-running-output-handler-to-obuffer-empty-test2 (os))

= os-running-output-handler-to-obuffer-empty-test2 (os))

Event: Disable trace-running-output-handler-to-obuffer-empty-test2.

Definition: os-time-for-running-output-handler-to-resume-task3 (os)

= '(tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-TO-RESUME-TASK3
(OS)
(TM
(PUTNTH
(TM-PC OS)
'0
(PUTNTH
(TM-SP OS)
'1
(PUTNTH
(TM-PACK-PSW (TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS))
'2
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'9
(PUTNTH '3231
'10
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
(OS-STATUS-TABLE OS)
'211
(PUTSEG (OS-OBUFFERS OS)

                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3195
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(PUTNTH '3231
 '0
 (PUTNTH '3310
  '1
  (PUTNTH
   (GETNTH '2 (TM-REGS OS))
   '2
   (PUTNTH
          (PLUS '371
                (TIMES '8
                       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
          '3
          (PUTNTH (PLUS '211
                        (TIMES '2
                               (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
                  '5
                  (TM-REGS OS))))))
'1
'0
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-resume-task3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os))

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-processor (os-running-output-handler-to-obuffer-empty-test2 (os),

os-time-for-running-output-handler-to-resume-task3 (os))

= os-running-output-handler-to-resume-task3 (os))

Event: Disable trace-running-output-handler-to-resume-task3.

Definition: os-time-for-running-output-handler-to-resume-task4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick)

(DEFN OS-RUNNING-OUTPUT-HANDLER-TO-RESUME-TASK4
 (OS)
 (TM
  (PUTNTH
   (TM-PC OS)
   '0
   (PUTNTH
    (TM-SP OS)
    '1
    (PUTNTH
     (TM-PACK-PSW (TM-CC OS)
                  (TM-ERROR OS)
                  (TM-SVCFLAG OS)
                  (TM-SVCID OS))
     '2
     (PUTNTH
      (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
      '9
      (PUTNTH '3231
       '10
       (PUTNTH
        (TM-R2 OS)
        '13
        (PUTNTH
         (TM-R3 OS)
         '14
         (PUTSEG
          (OS-NEW-TASK-TABLE OS)
          '15

(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
      (OS-STATUS-TABLE OS)
      '211
      (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
              '371
              (PUTSEG (OS-CODE OS)
                      '2547
                      (PUTNTH '2558
                              '3309
                              (PUTNTH '3204
                                      '3310
                                      (TM-MEMORY OS))))))))))))))))
(PUTNTH '3231
'0
(PUTNTH '3310
'1
(PUTNTH
(ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
               (TABLE '8 (OS-OBUFFERS OS))))
'2
(PUTNTH
(PLUS '371
      (TIMES '8
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
'3
(PUTNTH (PLUS '211
              (TIMES '2
                     (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
        '5
        (TM-REGS OS))))))
(TM-CC-VALUE
(TM-ALU-INCR-MOD
       (GETNTH '0
               (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                       (TABLE '8 (OS-OBUFFERS OS))))
       (GETNTH '3
               (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                       (TABLE '8 (OS-OBUFFERS OS))))))

(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'1
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-START-OUTPUT
           (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                                 (TABLE '8 (OS-OBUFFERS OS))))
           (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-resume-task4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-running-output-handler-to-obuffer-empty-test2 (os),

os-time-for-running-output-handler-to-resume-task4 (os))

= os-running-output-handler-to-resume-task4 (os))

Event: Disable trace-running-output-handler-to-resume-task4.

(DEFN
OS-RUNNING-OUTPUT-HANDLER-PATH3
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (OS-READYQ OS)))
         (OS-NEW-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (OS-READYQ OS))))

(OS-NEW-TASK-TABLE OS))
'1
(PUTNTH
(GETNTH (PLUS '8
       (TIMES '9
              (ARRAY-QFIRST (OS-READYQ OS))))
 (OS-NEW-TASK-TABLE OS))
'2
(PUTNTH
(TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
'9
(PUTNTH '3231
'10
(PUTNTH
(TM-R2 OS)
'13
(PUTNTH
(TM-R3 OS)
'14
(PUTSEG
(OS-NEW-TASK-TABLE OS)
'15
(PUTSEG
(OS-SEGMENT-TABLE OS)
'159
(PUTSEG
(OS-READYQ OS)
'191
(PUTSEG
      (OS-STATUS-TABLE OS)
      '211
      (PUTSEG (OS-OBUFFERS OS)
              '371
              (PUTSEG (OS-CODE OS)
                      '2547
                      (PUTNTH '2558
                              '3309
                              (PUTNTH '3238
                                      '3310
                                      (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)

(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)
(TM-CLEAR-OUTPUT-INTERRUPT (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-lpsw3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-running-output-handler-to-resume-task3 (os),

os-time-for-running-output-handler-to-lpsw (os))

= os-running-output-handler-path3 (os))

Event: Disable trace-running-output-handler-to-lpsw3.

(DEFN
OS-RUNNING-OUTPUT-HANDLER-PATH4
(OS)
(TM
(PUTNTH
 (GETNTH (TIMES '9
                (ARRAY-QFIRST (OS-READYQ OS)))
         (OS-NEW-TASK-TABLE OS))
 '0
 (PUTNTH
  (GETNTH (PLUS '1
                (TIMES '9
                       (ARRAY-QFIRST (OS-READYQ OS))))
          (OS-NEW-TASK-TABLE OS))
  '1
  (PUTNTH
   (GETNTH (PLUS '8
                 (TIMES '9
                        (ARRAY-QFIRST (OS-READYQ OS))))
           (OS-NEW-TASK-TABLE OS))
   '2

   (PUTNTH
    (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
    '9
    (PUTNTH '3231
     '10
     (PUTNTH
      (TM-R2 OS)
      '13
      (PUTNTH
       (TM-R3 OS)
       '14
       (PUTSEG
        (OS-NEW-TASK-TABLE OS)
        '15
        (PUTSEG
         (OS-SEGMENT-TABLE OS)
         '159
         (PUTSEG
          (OS-READYQ OS)
          '191
          (PUTSEG
                (OS-STATUS-TABLE OS)
                '211
                (PUTSEG (OS-OBUFFERS-WITH-DEQUEUED-CHARACTER OS)
                        '371
                        (PUTSEG (OS-CODE OS)
                                '2547
                                (PUTNTH '2558
                                        '3309
                                        (PUTNTH '3238
                                                '3310
                                                (TM-MEMORY OS))))))))))))))))
(TM-REGS OS)
(TM-CC OS)
(TM-ERROR OS)
(TM-SVCFLAG OS)
(TM-SVCID OS)
(TM-BASE OS)
(TM-LIMIT OS)
(TM-SLIMIT OS)
'0
'0
(TM-CLOCK OS)
(TM-IPORTS OS)

(TM-START-OUTPUT
       (ARRAY-QFIRST (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                             (TABLE '8 (OS-OBUFFERS OS))))
       (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
       (TM-OPORTS OS)))
NIL)

Theorem: trace-running-output-handler-to-lpsw4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-running-output-handler-to-resume-task4 (os),

os-time-for-running-output-handler-to-lpsw (os))

= os-running-output-handler-path4 (os))

Event: Disable trace-running-output-handler-to-lpsw4.

Definition: os-running-output-time1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Definition: os-running-output-time2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick)

Definition: os-time-for-running-output-handler-path1 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Theorem: rewrite-running-output-trace1 tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path1 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-thru-save-state (os)),

os-running-output-time1 (os))

Event: Disable rewrite-running-output-trace1.

Theorem: rewrite-running-output-trace2 tm-processor (os-running-output-handler-thru-save-state (os),

os-running-output-time1 (os))

= tm-processor (tm-processor (os-running-output-handler-thru-save-state (os),

os-time-for-running-output-handler-to-obuffer-empty-test (os)),

os-running-output-time2 (os))

Event: Disable rewrite-running-output-trace2.

Theorem: rewrite-running-output-trace3 tm-processor (os-running-output-handler-to-obuffer-empty-test (os),

os-running-output-time2 (os))

= tm-processor (tm-processor (os-running-output-handler-to-obuffer-empty-test (os),

os-time-for-running-output-handler-to-resume-task1 (os)),

os-time-for-running-output-handler-to-lpsw (os))

Event: Disable rewrite-running-output-trace3.

Theorem: trace-running-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path1 (os))

= os-running-output-handler-path1 (os))

Event: Disable trace-running-output-handler-path1.

Definition: os-running-output-time3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick)

Definition: os-running-output-time4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-time-for-running-output-handler-path2 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick)

Theorem: rewrite-running-output-trace4 tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path2 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-thru-save-state (os)),

os-running-output-time3 (os))

Event: Disable rewrite-running-output-trace4.

Theorem: rewrite-running-output-trace5 tm-processor (os-running-output-handler-thru-save-state (os),

os-running-output-time3 (os))

= tm-processor (tm-processor (os-running-output-handler-thru-save-state (os),

os-time-for-running-output-handler-to-obuffer-empty-test (os)),

os-running-output-time4 (os))

Event: Disable rewrite-running-output-trace5.

Theorem: rewrite-running-output-trace6 tm-processor (os-running-output-handler-to-obuffer-empty-test (os),

os-running-output-time4 (os))

= tm-processor (tm-processor (os-running-output-handler-to-obuffer-empty-test (os),

os-time-for-running-output-handler-to-resume-task2 (os)),

os-time-for-running-output-handler-to-lpsw (os))

Event: Disable rewrite-running-output-trace6.

Theorem: trace-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path2 (os))

= os-running-output-handler-path2 (os))

Event: Disable trace-running-output-handler-path2.

Definition: os-running-output-time5 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick)

Definition: os-running-output-time6 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick)

Definition: os-time-for-running-output-handler-path3 (os)

= '(tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick tick tick tick tick tick tick
      tick tick tick tick)

Theorem: rewrite-running-output-trace7 tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path3 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-thru-save-state (os)),

os-running-output-time5 (os))

Event: Disable rewrite-running-output-trace7.

Theorem: rewrite-running-output-trace8 tm-processor (os-running-output-handler-thru-save-state (os),

os-running-output-time5 (os))

= tm-processor (tm-processor (os-running-output-handler-thru-save-state (os),

os-time-for-running-output-handler-to-obuffer-empty-test2 (os)),

os-running-output-time6 (os))

Event: Disable rewrite-running-output-trace8.

Theorem: rewrite-running-output-trace9 tm-processor (os-running-output-handler-to-obuffer-empty-test2 (os),

os-running-output-time6 (os))

= tm-processor (tm-processor (os-running-output-handler-to-obuffer-empty-test2 (os),

os-time-for-running-output-handler-to-resume-task3 (os)),

os-time-for-running-output-handler-to-lpsw (os))

Event: Disable rewrite-running-output-trace9.

Theorem: trace-running-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

         ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path3 (os))

= os-running-output-handler-path3 (os))

Event: Disable trace-running-output-handler-path3.

Definition: os-running-output-time7 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick)

Definition: os-running-output-time8 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick)

Definition: os-time-for-running-output-handler-path4 (os)

= '(tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick tick tick tick tick
tick tick tick tick tick tick)

Theorem: rewrite-running-output-trace10 tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path4 (os))

= tm-processor (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-thru-save-state (os)),

os-running-output-time7 (os))

Event: Disable rewrite-running-output-trace10.

Theorem: rewrite-running-output-trace11 tm-processor (os-running-output-handler-thru-save-state (os),

os-running-output-time7 (os))

= tm-processor (tm-processor (os-running-output-handler-thru-save-state (os),

os-time-for-running-output-handler-to-obuffer-empty-test2 (os)),

os-running-output-time8 (os))

Event: Disable rewrite-running-output-trace11.

Theorem: rewrite-running-output-trace12 tm-processor (os-running-output-handler-to-obuffer-empty-test2 (os),

os-running-output-time8 (os))

= tm-processor (tm-processor (os-running-output-handler-to-obuffer-empty-test2 (os),

os-time-for-running-output-handler-to-resume-task4 (os)),

os-time-for-running-output-handler-to-lpsw (os))

Event: Disable rewrite-running-output-trace12.

Theorem: trace-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler-path4 (os))

= os-running-output-handler-path4 (os))

Event: Disable trace-running-output-handler-path4.

Definition: os-time-for-running-output-handler (os) = if getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os))

      = '4

then if array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-time-for-running-output-handler-path1 (os) else os-time-for-running-output-handler-path2 (os) endif

elseif array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-time-for-running-output-handler-path3 (os) else os-time-for-running-output-handler-path4 (os) endif

Definition: os-running-output-handler (os) = if getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os))

      = '4

then if array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-running-output-handler-path1 (os) else os-running-output-handler-path2 (os) endif

elseif array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))

then os-running-output-handler-path3 (os) else os-running-output-handler-path4 (os) endif

Theorem: trace-running-output-handler (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (¬ tm-waiting (os)))) → (tm-processor (os-intended-output-interrupt (os),

os-time-for-running-output-handler (os))

= os-running-output-handler (os))

Event: Disable trace-running-output-handler.

Event: Let us define the theory access-os-memory to consist of the following events: getnth-before-putseg, getnth-putnth-non-interference, getseg-after-putnth, getseg-after-putseg, getseg-before-putnth, getseg-before-putseg, getsegfor-length, getseg-getseg, getseg-within-putseg, length-array-deq, length-array-enq, length-getseg, length-putnth, length-putseg, plistp-array-deq, plistp-array-enq, plistp-getseg, plistp-putnth, plistp-putseg.

Theorem: good-tm-os-intended-clock-interrupt (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-tm (os-intended-clock-interrupt (os))

Event: Disable good-tm-os-intended-clock-interrupt.

Theorem: good-tm-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-tm (os-clock-interrupt-handler (os))

Event: Disable good-tm-os-clock-interrupt-handler.

Theorem: tm-slimit-os-clock-interrupt-handler tm-slimit (os-clock-interrupt-handler (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-clock-interrupt-handler.

Theorem: os-code-os-clock-interrupt-handler good-tm (os) → (os-code (os-clock-interrupt-handler (os)) = os-code (os))

Event: Disable os-code-os-clock-interrupt-handler.

Theorem: tm-interrupt-addresses-os-clock-interrupt-handler good-tm (os) → ((getnth ('3, tm-memory (os-clock-interrupt-handler (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-clock-interrupt-handler (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-clock-interrupt-handler (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-clock-interrupt-handler (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-clock-interrupt-handler (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-clock-interrupt-handler (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-clock-interrupt-handler.

Theorem: not-tm-in-supervisor-mode-os-clock-interrupt-handler ¬ tm-in-supervisor-mode (os-clock-interrupt-handler (os))

Event: Disable not-tm-in-supervisor-mode-os-clock-interrupt-handler.

Theorem: os-task-table-os-clock-interrupt-handler good-tm (os) → (os-task-table (os-clock-interrupt-handler (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-clock-interrupt-handler.

Theorem: os-segment-table-os-clock-interrupt-handler good-tm (os) → (os-segment-table (os-clock-interrupt-handler (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-clock-interrupt-handler.

Theorem: os-readyq-os-clock-interrupt-handler good-tm (os) → (os-readyq (os-clock-interrupt-handler (os))

= os-clock-new-readyq (os))

Event: Disable os-readyq-os-clock-interrupt-handler.

Theorem: finite-number-queuep-os-clock-new-readyq (good-os (os) ∧ (¬ tm-waiting (os))) → finite-number-queuep (os-clock-new-readyq (os), '16, '16)

Event: Disable finite-number-queuep-os-clock-new-readyq.

Theorem: not-array-qemptyp-os-clock-new-readyq (good-os (os) ∧ (¬ tm-waiting (os))) → (¬ array-qemptyp (os-clock-new-readyq (os)))

Event: Disable not-array-qemptyp-os-clock-new-readyq.

Theorem: os-ibuffers-os-clock-interrupt-handler good-tm (os) → (os-ibuffers (os-clock-interrupt-handler (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-clock-interrupt-handler.

Theorem: os-obuffers-os-clock-interrupt-handler good-tm (os) → (os-obuffers (os-clock-interrupt-handler (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-clock-interrupt-handler.

Theorem: os-mbuffers-os-clock-interrupt-handler good-tm (os) → (os-mbuffers (os-clock-interrupt-handler (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-clock-interrupt-handler.

Theorem: os-status-table-os-clock-interrupt-handler good-tm (os) → (os-status-table (os-clock-interrupt-handler (os))

= os-status-table (os))

Event: Disable os-status-table-os-clock-interrupt-handler.

Theorem: os-ready-set-os-clock-interrupt-handler good-tm (os) → (os-ready-set (os-clock-interrupt-handler (os)) = os-ready-set (os))

Event: Disable os-ready-set-os-clock-interrupt-handler.

Theorem: permutation-os-clock-new-readyq-os-ready-set (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (os-clock-new-readyq (os)),

os-ready-set (os-clock-interrupt-handler (os)))

Event: Disable permutation-os-clock-new-readyq-os-ready-set.

Theorem: tm-base-os-clock-interrupt-handler tm-base (os-clock-interrupt-handler (os)) = os-new-base (array-qfirst (os-clock-new-readyq (os)), os)

Event: Disable tm-base-os-clock-interrupt-handler.

Theorem: tm-limit-os-clock-interrupt-handler tm-limit (os-clock-interrupt-handler (os)) = os-new-limit (array-qfirst (os-clock-new-readyq (os)), os)

Event: Disable tm-limit-os-clock-interrupt-handler.

Theorem: tm-base-tm-limit-os-clock-interrupt-handler good-tm (os) → ((tm-base (os-clock-interrupt-handler (os))

= base (getnth (os-current-taskid (os-clock-interrupt-handler (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-clock-interrupt-handler (os))

= limit (getnth (os-current-taskid (os-clock-interrupt-handler (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-clock-interrupt-handler.

Theorem: not-tm-waiting-os-clock-interrupt-handler ¬ tm-waiting (os-clock-interrupt-handler (os))

Event: Disable not-tm-waiting-os-clock-interrupt-handler.

Theorem: good-os-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-os (os-clock-interrupt-handler (os))

Event: Disable good-os-os-clock-interrupt-handler.

Theorem: good-tm-os-intended-error-interrupt (good-os (os) ∧ (¬ tm-waiting (os))) → good-tm (os-intended-error-interrupt (os))

Event: Disable good-tm-os-intended-error-interrupt.

Theorem: good-tm-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → good-tm (os-error-handler-path1 (os))

Event: Disable good-tm-os-error-handler-path1.

Theorem: tm-slimit-os-error-handler-path1 tm-slimit (os-error-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-error-handler-path1.

Theorem: os-code-os-error-handler-path1 good-tm (os) → (os-code (os-error-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-error-handler-path1.

Theorem: tm-interrupt-addresses-os-error-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-error-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-error-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-error-handler-path1 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-error-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-error-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-error-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-error-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-error-handler-path1 ¬ tm-in-supervisor-mode (os-error-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-error-handler-path1.

Theorem: os-task-table-os-error-handler-path1 good-tm (os) → (os-task-table (os-error-handler-path1 (os)) = os-new-task-table (os))

Event: Disable os-task-table-os-error-handler-path1.

Theorem: os-segment-table-os-error-handler-path1 good-tm (os) → (os-segment-table (os-error-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-error-handler-path1.

Theorem: os-readyq-os-error-handler-path1 good-tm (os) → (os-readyq (os-error-handler-path1 (os)) = array-deq (os-readyq (os)))

Event: Disable os-readyq-os-error-handler-path1.

Theorem: os-ibuffers-os-error-handler-path1 good-tm (os) → (os-ibuffers (os-error-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-error-handler-path1.

Theorem: os-obuffers-os-error-handler-path1 good-tm (os) → (os-obuffers (os-error-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-error-handler-path1.

Theorem: os-mbuffers-os-error-handler-path1 good-tm (os) → (os-mbuffers (os-error-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-error-handler-path1.

Theorem: os-status-table-os-error-handler-path1 good-tm (os) → (os-status-table (os-error-handler-path1 (os))

= os-update-status (array-qfirst (os-readyq (os)), '1, '0, os))

Event: Disable os-status-table-os-error-handler-path1.

Event: Let us define the theory executable-theory to consist of the following events: *1*greaterp, *1*leq, *1*geq, *1*member, *1*iff, *1*ord-lessp, *1*ordinalp, *1*assoc, *1*pairlist, *1*subrp, *1*apply-subr, *1*formals, *1*body, *1*fix-cost, *1*strip-cars, *1*sum-cdrs, *1*v&c$, *1*v&c-apply$, *1*eval$, *1*quantifierinitial-value, *1*add-to-set, *1*append, *1*max, *1*union, *1*quantifier-operation, *1*for, *1*exp, *1*divides, *1*min, *1*length, *1*insert, *1*occurrences, *1*remove, *1*permutation, *1*plistp, *1*setp, *1*sorted, *1*getnth, *1*putnth, *1*getseg, *1*putseg, *1*fixlength, *1*firstn, *1*nthcdr, *1*nested-intervals, *1*getnth2, *1*putnth2, *1*reverse, *1*finite-numberp, *1*number-listp, *1*finitenumber-listp, *1*non-zero-listp, *1*tablep, *1*table, *1*flatten, *1*finite-number-tablep, *1*nonlast, *1*incr-mod, *1*decr-mod, *1*qfirst, *1*enq, *1*deq, *1*qemptyp, *1*qfullp, *1*qreplace, *1*qhead-field, *1*qtail-field, *1*qcurrlength-field, *1*qmaxlength-field, *1*qarray-field, *1*delta, *1*array-qindex-relation, *1*arrayqueuep, *1*array-enq, *1*array-deq, *1*array-qfirst, *1*array-qfullp, *1*arrayqemptyp, *1*array-nonlast, *1*array-qreplace, *1*delta-segment, *1*mapupqueue, *1*qfirst2, *1*enq2, *1*deq2, *1*qfullp2, *1*qemptyp2.

Theorem: good-status-list-os-status-table-os-error-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → good-status-list (table ('2,

os-status-table (os-error-handler-path1 (os))))

Event: Disable good-status-list-os-status-table-os-error-handler-path1.

Theorem: os-ready-set-os-error-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-error-handler-path1 (os))

= index-ready-set ('0,

table ('2,

os-update-status (array-qfirst (os-readyq (os)),

                                           '1,
                                           '0,

os))))

Event: Disable os-ready-set-os-error-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-error-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-error-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-error-handler-path1.

Theorem: tm-waiting-os-error-handler-path1 tm-waiting (os-error-handler-path1 (os))

Event: Disable tm-waiting-os-error-handler-path1.

Theorem: good-os-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → good-os (os-error-handler-path1 (os))

Event: Disable good-os-os-error-handler-path1.

Theorem: good-tm-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → good-tm (os-error-handler-path2 (os))

Event: Disable good-tm-os-error-handler-path2.

Theorem: tm-slimit-os-error-handler-path2 tm-slimit (os-error-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-error-handler-path2.

Theorem: os-code-os-error-handler-path2 good-tm (os) → (os-code (os-error-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-error-handler-path2.

Theorem: tm-interrupt-addresses-os-error-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-error-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-error-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-error-handler-path2 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-error-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-error-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-error-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-error-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-error-handler-path2 ¬ tm-in-supervisor-mode (os-error-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-error-handler-path2.

Theorem: os-task-table-os-error-handler-path2 good-tm (os) → (os-task-table (os-error-handler-path2 (os)) = os-new-task-table (os))

Event: Disable os-task-table-os-error-handler-path2.

Theorem: os-segment-table-os-error-handler-path2 good-tm (os) → (os-segment-table (os-error-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-error-handler-path2.

Theorem: os-readyq-os-error-handler-path2 good-tm (os) → (os-readyq (os-error-handler-path2 (os)) = array-deq (os-readyq (os)))

Event: Disable os-readyq-os-error-handler-path2.

Theorem: os-ibuffers-os-error-handler-path2 good-tm (os) → (os-ibuffers (os-error-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-error-handler-path2.

Theorem: os-obuffers-os-error-handler-path2 good-tm (os) → (os-obuffers (os-error-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-error-handler-path2.

Theorem: os-mbuffers-os-error-handler-path2 good-tm (os) → (os-mbuffers (os-error-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-error-handler-path2.

Theorem: os-status-table-os-error-handler-path2 good-tm (os) → (os-status-table (os-error-handler-path2 (os))

= os-update-status (array-qfirst (os-readyq (os)), '1, '0, os))

Event: Disable os-status-table-os-error-handler-path2.

Theorem: good-status-list-os-status-table-os-error-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → good-status-list (table ('2,

os-status-table (os-error-handler-path2 (os))))

Event: Disable good-status-list-os-status-table-os-error-handler-path2.

Theorem: os-ready-set-os-error-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-error-handler-path2 (os))

= index-ready-set ('0,

table ('2,

os-update-status (array-qfirst (os-readyq (os)),

                                          '1,
                                          '0,

os))))

Event: Disable os-ready-set-os-error-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-error-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-error-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-error-handler-path2.

Theorem: tm-base-os-error-handler-path2 tm-base (os-error-handler-path2 (os)) = os-new-base (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-base-os-error-handler-path2.

Theorem: tm-limit-os-error-handler-path2 tm-limit (os-error-handler-path2 (os)) = os-new-limit (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-limit-os-error-handler-path2.

Theorem: tm-base-tm-limit-os-error-handler-path2 good-tm (os) → ((tm-base (os-error-handler-path2 (os))

= base (getnth (os-current-taskid (os-error-handler-path2 (os)),

table ('2, os-segment-table (os)))))

∧ (tm-limit (os-error-handler-path2 (os))

= limit (getnth (os-current-taskid (os-error-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-error-handler-path2.

Theorem: not-tm-waiting-os-error-handler-path2 ¬ tm-waiting (os-error-handler-path2 (os))

Event: Disable not-tm-waiting-os-error-handler-path2.

Theorem: good-os-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → good-os (os-error-handler-path2 (os))

Event: Disable good-os-os-error-handler-path2.

Theorem: good-os-os-error-handler (good-os (os) ∧ (¬ tm-waiting (os))) → good-os (os-error-handler (os))

Event: Disable good-os-os-error-handler.

Theorem: good-tm-os-intended-svc-send-interrupt (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-tm (os-intended-svc-send-interrupt (os))

Event: Disable good-tm-os-intended-svc-send-interrupt.

Theorem: good-tm-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                     '16),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-tm (os-svc-send-handler-path1 (os))

Event: Disable good-tm-os-svc-send-handler-path1.

Theorem: tm-slimit-os-svc-send-handler-path1 tm-slimit (os-svc-send-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-send-handler-path1.

Theorem: os-code-os-svc-send-handler-path1 good-tm (os) → (os-code (os-svc-send-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-svc-send-handler-path1.

Theorem: tm-interrupt-addresses-os-svc-send-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-svc-send-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-send-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-send-handler-path1 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-send-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-send-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-send-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-send-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-svc-send-handler-path1 ¬ tm-in-supervisor-mode (os-svc-send-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-send-handler-path1.

Theorem: os-task-table-os-svc-send-handler-path1 good-tm (os) → (os-task-table (os-svc-send-handler-path1 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-send-handler-path1.

Theorem: os-segment-table-os-svc-send-handler-path1 good-tm (os) → (os-segment-table (os-svc-send-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-send-handler-path1.

Theorem: os-readyq-os-svc-send-handler-path1 good-tm (os) → (os-readyq (os-svc-send-handler-path1 (os))

= array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-send-handler-path1.

Theorem: os-ibuffers-os-svc-send-handler-path1 good-tm (os) → (os-ibuffers (os-svc-send-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-send-handler-path1.

Theorem: os-obuffers-os-svc-send-handler-path1 good-tm (os) → (os-obuffers (os-svc-send-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-send-handler-path1.

Theorem: os-mbuffers-os-svc-send-handler-path1 good-tm (os) → (os-mbuffers (os-svc-send-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-send-handler-path1.

Theorem: os-status-table-os-svc-send-handler-path1 good-tm (os) → (os-status-table (os-svc-send-handler-path1 (os))

= os-update-status (array-qfirst (os-readyq (os)),

                        '2,

os-destid (os, '16), os))

Event: Disable os-status-table-os-svc-send-handler-path1.

Theorem: os-ready-set-os-svc-send-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-send-handler-path1 (os))

= index-ready-set ('0,

putnth (cons ('2,

cons (os-destid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-send-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-send-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-send-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-send-handler-path1.

Theorem: tm-waiting-os-svc-send-handler-path1 tm-waiting (os-svc-send-handler-path1 (os))

Event: Disable tm-waiting-os-svc-send-handler-path1.

Theorem: good-os-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                     '16),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-os (os-svc-send-handler-path1 (os))

Event: Disable good-os-os-svc-send-handler-path1.

Theorem: good-tm-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                     '16),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-tm (os-svc-send-handler-path2 (os))

Event: Disable good-tm-os-svc-send-handler-path2.

Theorem: tm-slimit-os-svc-send-handler-path2 tm-slimit (os-svc-send-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-send-handler-path2.

Theorem: os-code-os-svc-send-handler-path2 good-tm (os) → (os-code (os-svc-send-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-svc-send-handler-path2.

Theorem: tm-interrupt-addresses-os-svc-send-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-svc-send-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-send-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-send-handler-path2 (os)))

= getnth ('5, tm-memory (os)))

∧ ((getnth ('6,

tm-memory (os-svc-send-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-send-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-send-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-send-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-svc-send-handler-path2 ¬ tm-in-supervisor-mode (os-svc-send-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-send-handler-path2.

Theorem: os-task-table-os-svc-send-handler-path2 good-tm (os) → (os-task-table (os-svc-send-handler-path2 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-send-handler-path2.

Theorem: os-segment-table-os-svc-send-handler-path2 good-tm (os) → (os-segment-table (os-svc-send-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-send-handler-path2.

Theorem: os-readyq-os-svc-send-handler-path2 good-tm (os) → (os-readyq (os-svc-send-handler-path2 (os))

= array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-send-handler-path2.

Theorem: os-ibuffers-os-svc-send-handler-path2 good-tm (os) → (os-ibuffers (os-svc-send-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-send-handler-path2.

Theorem: os-obuffers-os-svc-send-handler-path2 good-tm (os) → (os-obuffers (os-svc-send-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-send-handler-path2.

Theorem: os-mbuffers-os-svc-send-handler-path2 good-tm (os) → (os-mbuffers (os-svc-send-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-send-handler-path2.

Theorem: os-status-table-os-svc-send-handler-path2 good-tm (os) → (os-status-table (os-svc-send-handler-path2 (os))

= os-update-status (array-qfirst (os-readyq (os)),

                        '2,

os-destid (os, '16), os))

Event: Disable os-status-table-os-svc-send-handler-path2.

Theorem: os-ready-set-os-svc-send-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-send-handler-path2 (os))

= index-ready-set ('0,

putnth (cons ('2,

cons (os-destid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-send-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-send-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-send-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-send-handler-path2.

Theorem: tm-base-os-svc-send-handler-path2 tm-base (os-svc-send-handler-path2 (os)) = os-new-base (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-base-os-svc-send-handler-path2.

Theorem: tm-limit-os-svc-send-handler-path2 tm-limit (os-svc-send-handler-path2 (os)) = os-new-limit (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-limit-os-svc-send-handler-path2.

Theorem: tm-base-tm-limit-os-svc-send-handler-path2 good-tm (os)

→ ((tm-base (os-svc-send-handler-path2 (os))

= base (getnth (os-current-taskid (os-svc-send-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-send-handler-path2 (os))

= limit (getnth (os-current-taskid (os-svc-send-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-send-handler-path2.

Theorem: not-tm-waiting-os-svc-send-handler-path2 ¬ tm-waiting (os-svc-send-handler-path2 (os))

Event: Disable not-tm-waiting-os-svc-send-handler-path2.

Theorem: good-os-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                     '16),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-os (os-svc-send-handler-path2 (os))

Event: Disable good-os-os-svc-send-handler-path2.

Theorem: good-tm-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                        '16),

os)))

∧ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

                       = '3)

∧ (getnth ('1

                                 + ('2

∗ os-destid (os,

                                                '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ good-tm (os-svc-send-handler-path3 (os))

Event: Disable good-tm-os-svc-send-handler-path3.

Theorem: tm-slimit-os-svc-send-handler-path3 tm-slimit (os-svc-send-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-send-handler-path3.

Theorem: os-code-os-svc-send-handler-path3 good-tm (os) → (os-code (os-svc-send-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-svc-send-handler-path3.

Theorem: tm-interrupt-addresses-os-svc-send-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-svc-send-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-send-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-send-handler-path3 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-send-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-send-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-send-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-send-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-svc-send-handler-path3 ¬ tm-in-supervisor-mode (os-svc-send-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-send-handler-path3.

Theorem: os-task-table-os-svc-send-handler-path3 good-tm (os) → (os-task-table (os-svc-send-handler-path3 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-send-handler-path3.

Theorem: os-segment-table-os-svc-send-handler-path3 good-tm (os) → (os-segment-table (os-svc-send-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-send-handler-path3.

Theorem: os-readyq-os-svc-send-handler-path3 good-tm (os) → (os-readyq (os-svc-send-handler-path3 (os))

= array-enq (os-destid (os, '16), os-readyq (os)))

Event: Disable os-readyq-os-svc-send-handler-path3.

Theorem: os-ibuffers-os-svc-send-handler-path3 good-tm (os) → (os-ibuffers (os-svc-send-handler-path3 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-send-handler-path3.

Theorem: os-obuffers-os-svc-send-handler-path3 good-tm (os) → (os-obuffers (os-svc-send-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-send-handler-path3.

Theorem: os-mbuffers-os-svc-send-handler-path3 good-tm (os) → (os-mbuffers (os-svc-send-handler-path3 (os))

= os-mbuffers-with-enqueued-message (os))

Event: Disable os-mbuffers-os-svc-send-handler-path3.

Theorem: finite-number-queue-listp-os-mbuffers-with-enqueued-message (good-os (os)

∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os)))))

→ finite-number-queue-listp (table ('8,

os-mbuffers-with-enqueued-message (os)),

                          '4,
                          '65536)

Event: Disable finite-number-queue-listp-os-mbuffers-with-enqueued-message.

Theorem: os-status-table-os-svc-send-handler-path3 good-tm (os) → (os-status-table (os-svc-send-handler-path3 (os))

= putseg ('(0 0), '2 ∗ os-destid (os, '16), os-status-table (os)))

Event: Disable os-status-table-os-svc-send-handler-path3.

Theorem: os-ready-set-os-svc-send-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-send-handler-path3 (os))

= index-ready-set ('0,

putnth ('(0 0), os-destid (os, '16), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-send-handler-path3.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

= '3)))

→ permutation (mapup-queue (array-enq (os-destid (os, '16), os-readyq (os))), os-ready-set (os-svc-send-handler-path3 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-send-handler-path3.

Theorem: not-tm-waiting-os-svc-send-handler-path3 ¬ tm-waiting (os-svc-send-handler-path3 (os))

Event: Disable not-tm-waiting-os-svc-send-handler-path3.

Theorem: tm-base-os-svc-send-handler-path3 tm-base (os-svc-send-handler-path3 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-send-handler-path3.

Theorem: tm-limit-os-svc-send-handler-path3 tm-limit (os-svc-send-handler-path3 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-send-handler-path3.

Theorem: tm-base-tm-limit-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

= '3)))

→ ((tm-base (os-svc-send-handler-path3 (os))

= base (getnth (os-current-taskid (os-svc-send-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-send-handler-path3 (os))

= limit (getnth (os-current-taskid (os-svc-send-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-send-handler-path3.

Theorem: finite-numberp-os-destid (os-destid (os, '16) ∈ N) ∧ ((os-destid (os, '16) < '16)

∧ finite-numberp (os-destid (os, '16), '16))

Event: Disable finite-numberp-os-destid.

Theorem: good-os-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                        '16),

os)))

∧ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

                       = '3)

∧ (getnth ('1

                                 + ('2

∗ os-destid (os,

                                                '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ good-os (os-svc-send-handler-path3 (os))

Event: Disable good-os-os-svc-send-handler-path3.

Theorem: good-tm-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                        '16),

os)))

∧ (¬ ((getnth ('2

∗ os-destid (os,

                                           '16),

os-status-table (os))

                         = '3)

∧ (getnth ('1

                                   + ('2

∗ os-destid (os,

                                                   '16)),

os-status-table (os)) = os-current-taskid (os)))))))))

→ good-tm (os-svc-send-handler-path4 (os))

Event: Disable good-tm-os-svc-send-handler-path4.

Theorem: tm-slimit-os-svc-send-handler-path4 tm-slimit (os-svc-send-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-send-handler-path4.

Theorem: os-code-os-svc-send-handler-path4 good-tm (os) → (os-code (os-svc-send-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-svc-send-handler-path4.

Theorem: tm-interrupt-addresses-os-svc-send-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-svc-send-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-send-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-send-handler-path4 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-send-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-send-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-send-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-send-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-svc-send-handler-path4 ¬ tm-in-supervisor-mode (os-svc-send-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-send-handler-path4.

Theorem: os-task-table-os-svc-send-handler-path4 good-tm (os) → (os-task-table (os-svc-send-handler-path4 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-send-handler-path4.

Theorem: os-segment-table-os-svc-send-handler-path4 good-tm (os) → (os-segment-table (os-svc-send-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-send-handler-path4.

Theorem: os-readyq-os-svc-send-handler-path4 good-tm (os) → (os-readyq (os-svc-send-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-svc-send-handler-path4.

Theorem: os-ibuffers-os-svc-send-handler-path4 good-tm (os) → (os-ibuffers (os-svc-send-handler-path4 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-send-handler-path4.

Theorem: os-obuffers-os-svc-send-handler-path4 good-tm (os) → (os-obuffers (os-svc-send-handler-path4 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-send-handler-path4.

Theorem: os-mbuffers-os-svc-send-handler-path4 good-tm (os) → (os-mbuffers (os-svc-send-handler-path4 (os))

= os-mbuffers-with-enqueued-message (os))

Event: Disable os-mbuffers-os-svc-send-handler-path4.

Theorem: os-status-table-os-svc-send-handler-path4 good-tm (os) → (os-status-table (os-svc-send-handler-path4 (os))

= os-status-table (os))

Event: Disable os-status-table-os-svc-send-handler-path4.

Theorem: os-ready-set-os-svc-send-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-send-handler-path4 (os)) = os-ready-set (os))

Event: Disable os-ready-set-os-svc-send-handler-path4.

Theorem: not-tm-waiting-os-svc-send-handler-path4 ¬ tm-waiting (os-svc-send-handler-path4 (os))

Event: Disable not-tm-waiting-os-svc-send-handler-path4.

Theorem: tm-base-os-svc-send-handler-path4 tm-base (os-svc-send-handler-path4 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-send-handler-path4.

Theorem: tm-limit-os-svc-send-handler-path4 tm-limit (os-svc-send-handler-path4 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-send-handler-path4.

Theorem: tm-base-tm-limit-os-svc-send-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-svc-send-handler-path4 (os))

= base (getnth (os-current-taskid (os-svc-send-handler-path4 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-send-handler-path4 (os))

= limit (getnth (os-current-taskid (os-svc-send-handler-path4 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-send-handler-path4.

Theorem: good-os-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                        '16),

os)))

∧ (¬ ((getnth ('2

∗ os-destid (os,

                                           '16),

os-status-table (os))

                         = '3)

∧ (getnth ('1

                                   + ('2

∗ os-destid (os,

                                                   '16)),

os-status-table (os)) = os-current-taskid (os)))))))))

→ good-os (os-svc-send-handler-path4 (os))

Event: Disable good-os-os-svc-send-handler-path4.

Theorem: good-os-os-svc-send-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '0)))) → good-os (os-svc-send-handler (os))

Event: Disable good-os-os-svc-send-handler.

Theorem: good-tm-os-intended-svc-receive-interrupt (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-tm (os-intended-svc-receive-interrupt (os))

Event: Disable good-tm-os-intended-svc-receive-interrupt.

Theorem: good-tm-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                       '16),

os-current-taskid (os), os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-tm (os-svc-receive-handler-path1 (os))

Event: Disable good-tm-os-svc-receive-handler-path1.

Theorem: tm-slimit-os-svc-receive-handler-path1 tm-slimit (os-svc-receive-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-receive-handler-path1.

Theorem: os-code-os-svc-receive-handler-path1 good-tm (os) → (os-code (os-svc-receive-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-svc-receive-handler-path1.

Theorem: tm-interrupt-addresses-os-svc-receive-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-svc-receive-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-receive-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-svc-receive-handler-path1 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-receive-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-receive-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-receive-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-receive-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-svc-receive-handler-path1 ¬ tm-in-supervisor-mode (os-svc-receive-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-receive-handler-path1.

Theorem: os-task-table-os-svc-receive-handler-path1 good-tm (os) → (os-task-table (os-svc-receive-handler-path1 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-receive-handler-path1.

Theorem: os-segment-table-os-svc-receive-handler-path1 good-tm (os) → (os-segment-table (os-svc-receive-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-receive-handler-path1.

Theorem: os-readyq-os-svc-receive-handler-path1 good-tm (os) → (os-readyq (os-svc-receive-handler-path1 (os))

= array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-receive-handler-path1.

Theorem: os-ibuffers-os-svc-receive-handler-path1 good-tm (os) → (os-ibuffers (os-svc-receive-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-receive-handler-path1.

Theorem: os-obuffers-os-svc-receive-handler-path1 good-tm (os) → (os-obuffers (os-svc-receive-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-receive-handler-path1.

Theorem: os-mbuffers-os-svc-receive-handler-path1 good-tm (os) → (os-mbuffers (os-svc-receive-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-receive-handler-path1.

Theorem: os-status-table-os-svc-receive-handler-path1 good-tm (os) → (os-status-table (os-svc-receive-handler-path1 (os))

= os-update-status (array-qfirst (os-readyq (os)),

                       '3,

os-srcid (os, '16), os))

Event: Disable os-status-table-os-svc-receive-handler-path1.

Theorem: os-ready-set-os-svc-receive-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-receive-handler-path1 (os))

= index-ready-set ('0,

putnth (cons ('3, cons (os-srcid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-receive-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-receive-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-receive-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-receive-handler-path1.

Theorem: tm-waiting-os-svc-receive-handler-path1 tm-waiting (os-svc-receive-handler-path1 (os))

Event: Disable tm-waiting-os-svc-receive-handler-path1.

Theorem: good-os-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                       '16),

os-current-taskid (os), os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-os (os-svc-receive-handler-path1 (os))

Event: Disable good-os-os-svc-receive-handler-path1.

Theorem: good-tm-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                       '16),

os-current-taskid (os), os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-tm (os-svc-receive-handler-path2 (os))

Event: Disable good-tm-os-svc-receive-handler-path2.

Theorem: tm-slimit-os-svc-receive-handler-path2 tm-slimit (os-svc-receive-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-receive-handler-path2.

Theorem: os-code-os-svc-receive-handler-path2 good-tm (os) → (os-code (os-svc-receive-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-svc-receive-handler-path2.

Theorem: tm-interrupt-addresses-os-svc-receive-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-svc-receive-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-receive-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-svc-receive-handler-path2 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-receive-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-receive-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-receive-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-receive-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-svc-receive-handler-path2 ¬ tm-in-supervisor-mode (os-svc-receive-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-receive-handler-path2.

Theorem: os-task-table-os-svc-receive-handler-path2 good-tm (os) → (os-task-table (os-svc-receive-handler-path2 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-receive-handler-path2.

Theorem: os-segment-table-os-svc-receive-handler-path2 good-tm (os) → (os-segment-table (os-svc-receive-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-receive-handler-path2.

Theorem: os-readyq-os-svc-receive-handler-path2 good-tm (os) → (os-readyq (os-svc-receive-handler-path2 (os))

= array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-receive-handler-path2.

Theorem: os-ibuffers-os-svc-receive-handler-path2 good-tm (os) → (os-ibuffers (os-svc-receive-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-receive-handler-path2.

Theorem: os-obuffers-os-svc-receive-handler-path2 good-tm (os) → (os-obuffers (os-svc-receive-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-receive-handler-path2.

Theorem: os-mbuffers-os-svc-receive-handler-path2 good-tm (os) → (os-mbuffers (os-svc-receive-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-receive-handler-path2.

Theorem: os-status-table-os-svc-receive-handler-path2 good-tm (os) → (os-status-table (os-svc-receive-handler-path2 (os))

= os-update-status (array-qfirst (os-readyq (os)),

                       '3,

os-srcid (os, '16), os))

Event: Disable os-status-table-os-svc-receive-handler-path2.

Theorem: os-ready-set-os-svc-receive-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-receive-handler-path2 (os))

= index-ready-set ('0,

putnth (cons ('3, cons (os-srcid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-receive-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-receive-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-receive-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-receive-handler-path2.

Theorem: tm-base-os-svc-receive-handler-path2 tm-base (os-svc-receive-handler-path2 (os)) = os-new-base (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-base-os-svc-receive-handler-path2.

Theorem: tm-limit-os-svc-receive-handler-path2 tm-limit (os-svc-receive-handler-path2 (os)) = os-new-limit (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-limit-os-svc-receive-handler-path2.

Theorem: tm-base-tm-limit-os-svc-receive-handler-path2 good-tm (os) → ((tm-base (os-svc-receive-handler-path2 (os))

= base (getnth (os-current-taskid (os-svc-receive-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-receive-handler-path2 (os))

= limit (getnth (os-current-taskid (os-svc-receive-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-receive-handler-path2.

Theorem: not-tm-waiting-os-svc-receive-handler-path2 ¬ tm-waiting (os-svc-receive-handler-path2 (os))

Event: Disable not-tm-waiting-os-svc-receive-handler-path2.

Theorem: good-os-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                       '16),

os-current-taskid (os), os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-os (os-svc-receive-handler-path2 (os))

Event: Disable good-os-os-svc-receive-handler-path2.

Theorem: good-tm-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                          '16),

os-current-taskid (os), os)))

∧ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                       = '2)

∧ (getnth ('1

                                 + ('2

∗ os-srcid (os,

                                               '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ good-tm (os-svc-receive-handler-path3 (os))

Event: Disable good-tm-os-svc-receive-handler-path3.

Theorem: tm-slimit-os-svc-receive-handler-path3 tm-slimit (os-svc-receive-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-receive-handler-path3.

Theorem: os-code-os-svc-receive-handler-path3 good-tm (os) → (os-code (os-svc-receive-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-svc-receive-handler-path3.

Theorem: tm-interrupt-addresses-os-svc-receive-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-svc-receive-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-receive-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-svc-receive-handler-path3 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-receive-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-receive-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-receive-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-receive-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-svc-receive-handler-path3 ¬ tm-in-supervisor-mode (os-svc-receive-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-receive-handler-path3.

Theorem: os-task-table-os-svc-receive-handler-path3 good-tm (os) → (os-task-table (os-svc-receive-handler-path3 (os))

= os-task-table-with-delivered-message (os))

Event: Disable os-task-table-os-svc-receive-handler-path3.

Theorem: lessp-crock-for-good-cpu-list-os-task-table-with-delivered-message

 (n < '16) → (('144 < ('9 + ('9 ∗ n))) = '*1*false)

Event: Disable lessp-crock-for-good-cpu-list-os-task-table-with-delivered-message.

Theorem: good-cpu-list-os-task-table-with-delivered-message (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os),

os)))))

→ good-cpu-list (table ('9, os-task-table-with-delivered-message (os)))

Event: Disable good-cpu-list-os-task-table-with-delivered-message.

Theorem: os-segment-table-os-svc-receive-handler-path3 good-tm (os) → (os-segment-table (os-svc-receive-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-receive-handler-path3.

Theorem: os-readyq-os-svc-receive-handler-path3 good-tm (os) → (os-readyq (os-svc-receive-handler-path3 (os))

= array-enq (os-srcid (os, '16), os-readyq (os)))

Event: Disable os-readyq-os-svc-receive-handler-path3.

Theorem: os-ibuffers-os-svc-receive-handler-path3 good-tm (os) → (os-ibuffers (os-svc-receive-handler-path3 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-receive-handler-path3.

Theorem: os-obuffers-os-svc-receive-handler-path3 good-tm (os) → (os-obuffers (os-svc-receive-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-receive-handler-path3.

Theorem: os-mbuffers-os-svc-receive-handler-path3 good-tm (os) → (os-mbuffers (os-svc-receive-handler-path3 (os))

= os-mbuffers-with-dequeued-message (os))

Event: Disable os-mbuffers-os-svc-receive-handler-path3.

Theorem: finite-number-queue-listp-os-mbuffers-with-dequeued-message (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)))))

→ finite-number-queue-listp (table ('8,

os-mbuffers-with-dequeued-message (os)),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-mbuffers-with-dequeued-message.

Theorem: os-status-table-os-svc-receive-handler-path3 good-tm (os) → (os-status-table (os-svc-receive-handler-path3 (os))

= os-update-status (os-srcid (os, '16), '0, '0, os))

Event: Disable os-status-table-os-svc-receive-handler-path3.

Theorem: os-ready-set-os-svc-receive-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-receive-handler-path3 (os))

= index-ready-set ('0,

putnth ('(0 0), os-srcid (os, '16), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-receive-handler-path3.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

= '2)))

→ permutation (mapup-queue (array-enq (os-srcid (os, '16), os-readyq (os))), os-ready-set (os-svc-receive-handler-path3 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-receive-handler-path3.

Theorem: not-tm-waiting-os-svc-receive-handler-path3 ¬ tm-waiting (os-svc-receive-handler-path3 (os))

Event: Disable not-tm-waiting-os-svc-receive-handler-path3.

Theorem: tm-base-os-svc-receive-handler-path3 tm-base (os-svc-receive-handler-path3 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-receive-handler-path3.

Theorem: tm-limit-os-svc-receive-handler-path3 tm-limit (os-svc-receive-handler-path3 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-receive-handler-path3.

Theorem: tm-base-tm-limit-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

= '2)))

→ ((tm-base (os-svc-receive-handler-path3 (os))

= base (getnth (os-current-taskid (os-svc-receive-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-receive-handler-path3 (os))

= limit (getnth (os-current-taskid (os-svc-receive-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-receive-handler-path3.

Theorem: finite-numberp-os-srcid (os-srcid (os, '16) ∈ N) ∧ ((os-srcid (os, '16) < '16)

∧ finite-numberp (os-srcid (os, '16), '16))

Event: Disable finite-numberp-os-srcid.

Theorem: good-os-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                          '16),

os-current-taskid (os), os)))

∧ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                       = '2)

∧ (getnth ('1

                                 + ('2

∗ os-srcid (os,

                                               '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ good-os (os-svc-receive-handler-path3 (os))

Event: Disable good-os-os-svc-receive-handler-path3.

Theorem: good-tm-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                          '16),

os-current-taskid (os), os)))

∧ (¬ ((getnth ('2

∗ os-srcid (os,

                                          '16),

os-status-table (os))

                         = '2)

∧ (getnth ('1

                                   + ('2

∗ os-srcid (os,

                                                  '16)),

os-status-table (os)) = os-current-taskid (os)))))))))

→ good-tm (os-svc-receive-handler-path4 (os))

Event: Disable good-tm-os-svc-receive-handler-path4.

Theorem: tm-slimit-os-svc-receive-handler-path4 tm-slimit (os-svc-receive-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-receive-handler-path4.

Theorem: os-code-os-svc-receive-handler-path4 good-tm (os) → (os-code (os-svc-receive-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-svc-receive-handler-path4.

Theorem: tm-interrupt-addresses-os-svc-receive-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-svc-receive-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-receive-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-svc-receive-handler-path4 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-receive-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-receive-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-receive-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-receive-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-svc-receive-handler-path4 ¬ tm-in-supervisor-mode (os-svc-receive-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-receive-handler-path4.

Theorem: os-task-table-os-svc-receive-handler-path4 good-tm (os) → (os-task-table (os-svc-receive-handler-path4 (os))

= os-task-table-with-delivered-message (os))

Event: Disable os-task-table-os-svc-receive-handler-path4.

Theorem: os-segment-table-os-svc-receive-handler-path4 good-tm (os) → (os-segment-table (os-svc-receive-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-receive-handler-path4.

Theorem: os-readyq-os-svc-receive-handler-path4 good-tm (os) → (os-readyq (os-svc-receive-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-svc-receive-handler-path4.

Theorem: os-ibuffers-os-svc-receive-handler-path4 good-tm (os) → (os-ibuffers (os-svc-receive-handler-path4 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-receive-handler-path4.

Theorem: os-obuffers-os-svc-receive-handler-path4 good-tm (os) → (os-obuffers (os-svc-receive-handler-path4 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-receive-handler-path4.

Theorem: os-mbuffers-os-svc-receive-handler-path4 good-tm (os) → (os-mbuffers (os-svc-receive-handler-path4 (os))

= os-mbuffers-with-dequeued-message (os))

Event: Disable os-mbuffers-os-svc-receive-handler-path4.

Theorem: os-status-table-os-svc-receive-handler-path4 good-tm (os) → (os-status-table (os-svc-receive-handler-path4 (os))

= os-status-table (os))

Event: Disable os-status-table-os-svc-receive-handler-path4.

Theorem: os-ready-set-os-svc-receive-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-receive-handler-path4 (os)) = os-ready-set (os))

Event: Disable os-ready-set-os-svc-receive-handler-path4.

Theorem: not-tm-waiting-os-svc-receive-handler-path4 ¬ tm-waiting (os-svc-receive-handler-path4 (os))

Event: Disable not-tm-waiting-os-svc-receive-handler-path4.

Theorem: tm-base-os-svc-receive-handler-path4 tm-base (os-svc-receive-handler-path4 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-receive-handler-path4.

Theorem: tm-limit-os-svc-receive-handler-path4 tm-limit (os-svc-receive-handler-path4 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-receive-handler-path4.

Theorem: tm-base-tm-limit-os-svc-receive-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-svc-receive-handler-path4 (os))

= base (getnth (os-current-taskid (os-svc-receive-handler-path4 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-receive-handler-path4 (os))

= limit (getnth (os-current-taskid (os-svc-receive-handler-path4 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-receive-handler-path4.

Theorem: good-os-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                          '16),

os-current-taskid (os), os)))

∧ (¬ ((getnth ('2

∗ os-srcid (os,

                                          '16),

os-status-table (os))

                         = '2)

∧ (getnth ('1

                                   + ('2

∗ os-srcid (os,

                                                  '16)),

os-status-table (os)) = os-current-taskid (os)))))))))

→ good-os (os-svc-receive-handler-path4 (os))

Event: Disable good-os-os-svc-receive-handler-path4.

Theorem: good-os-os-svc-receive-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '1)))) → good-os (os-svc-receive-handler (os))

Event: Disable good-os-os-svc-receive-handler.

Theorem: good-tm-os-intended-svc-tyi-interrupt (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-tm (os-intended-svc-tyi-interrupt (os))

Event: Disable good-tm-os-intended-svc-tyi-interrupt.

Theorem: good-tm-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-tm (os-svc-tyi-handler-path1 (os))

Event: Disable good-tm-os-svc-tyi-handler-path1.

Theorem: tm-slimit-os-svc-tyi-handler-path1 tm-slimit (os-svc-tyi-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyi-handler-path1.

Theorem: os-code-os-svc-tyi-handler-path1 good-tm (os) → (os-code (os-svc-tyi-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyi-handler-path1.

Theorem: tm-interrupt-addresses-os-svc-tyi-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyi-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyi-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyi-handler-path1 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-tyi-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyi-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyi-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyi-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-svc-tyi-handler-path1 ¬ tm-in-supervisor-mode (os-svc-tyi-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyi-handler-path1.

Theorem: os-task-table-os-svc-tyi-handler-path1 good-tm (os) → (os-task-table (os-svc-tyi-handler-path1 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-tyi-handler-path1.

Theorem: os-segment-table-os-svc-tyi-handler-path1 good-tm (os) → (os-segment-table (os-svc-tyi-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyi-handler-path1.

Theorem: os-readyq-os-svc-tyi-handler-path1 good-tm (os) → (os-readyq (os-svc-tyi-handler-path1 (os)) = array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-tyi-handler-path1.

Theorem: os-ibuffers-os-svc-tyi-handler-path1 good-tm (os) → (os-ibuffers (os-svc-tyi-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-tyi-handler-path1.

Theorem: os-obuffers-os-svc-tyi-handler-path1 good-tm (os) → (os-obuffers (os-svc-tyi-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-tyi-handler-path1.

Theorem: os-mbuffers-os-svc-tyi-handler-path1 good-tm (os) → (os-mbuffers (os-svc-tyi-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyi-handler-path1.

Theorem: os-status-table-os-svc-tyi-handler-path1 good-tm (os) → (os-status-table (os-svc-tyi-handler-path1 (os))

= os-update-status (array-qfirst (os-readyq (os)), '5, '0, os))

Event: Disable os-status-table-os-svc-tyi-handler-path1.

Theorem: os-ready-set-os-svc-tyi-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-tyi-handler-path1 (os))

= index-ready-set ('0,

putnth ('(5 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-tyi-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-tyi-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-tyi-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-tyi-handler-path1.

Theorem: tm-waiting-os-svc-tyi-handler-path1 tm-waiting (os-svc-tyi-handler-path1 (os))

Event: Disable tm-waiting-os-svc-tyi-handler-path1.

Theorem: good-os-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-os (os-svc-tyi-handler-path1 (os))

Event: Disable good-os-os-svc-tyi-handler-path1.

Theorem: good-tm-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-tm (os-svc-tyi-handler-path2 (os))

Event: Disable good-tm-os-svc-tyi-handler-path2.

Theorem: tm-slimit-os-svc-tyi-handler-path2 tm-slimit (os-svc-tyi-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyi-handler-path2.

Theorem: os-code-os-svc-tyi-handler-path2 good-tm (os) → (os-code (os-svc-tyi-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyi-handler-path2.

Theorem: tm-interrupt-addresses-os-svc-tyi-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyi-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyi-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyi-handler-path2 (os)))

= getnth ('5, tm-memory (os)))

∧ ((getnth ('6,

tm-memory (os-svc-tyi-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyi-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyi-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyi-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-svc-tyi-handler-path2 ¬ tm-in-supervisor-mode (os-svc-tyi-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyi-handler-path2.

Theorem: os-task-table-os-svc-tyi-handler-path2 good-tm (os) → (os-task-table (os-svc-tyi-handler-path2 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-tyi-handler-path2.

Theorem: os-segment-table-os-svc-tyi-handler-path2 good-tm (os) → (os-segment-table (os-svc-tyi-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyi-handler-path2.

Theorem: os-readyq-os-svc-tyi-handler-path2 good-tm (os) → (os-readyq (os-svc-tyi-handler-path2 (os)) = array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-tyi-handler-path2.

Theorem: os-ibuffers-os-svc-tyi-handler-path2 good-tm (os) → (os-ibuffers (os-svc-tyi-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-tyi-handler-path2.

Theorem: os-obuffers-os-svc-tyi-handler-path2 good-tm (os) → (os-obuffers (os-svc-tyi-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-tyi-handler-path2.

Theorem: os-mbuffers-os-svc-tyi-handler-path2 good-tm (os) → (os-mbuffers (os-svc-tyi-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyi-handler-path2.

Theorem: os-status-table-os-svc-tyi-handler-path2 good-tm (os) → (os-status-table (os-svc-tyi-handler-path2 (os))

= os-update-status (array-qfirst (os-readyq (os)), '5, '0, os))

Event: Disable os-status-table-os-svc-tyi-handler-path2.

Theorem: os-ready-set-os-svc-tyi-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-tyi-handler-path2 (os))

= index-ready-set ('0,

putnth ('(5 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-tyi-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-tyi-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-tyi-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-tyi-handler-path2.

Theorem: tm-base-os-svc-tyi-handler-path2 tm-base (os-svc-tyi-handler-path2 (os)) = os-new-base (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-base-os-svc-tyi-handler-path2.

Theorem: tm-limit-os-svc-tyi-handler-path2 tm-limit (os-svc-tyi-handler-path2 (os)) = os-new-limit (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-limit-os-svc-tyi-handler-path2.

Theorem: tm-base-tm-limit-os-svc-tyi-handler-path2 good-tm (os) → ((tm-base (os-svc-tyi-handler-path2 (os))

= base (getnth (os-current-taskid (os-svc-tyi-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-tyi-handler-path2 (os))

= limit (getnth (os-current-taskid (os-svc-tyi-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-tyi-handler-path2.

Theorem: not-tm-waiting-os-svc-tyi-handler-path2 ¬ tm-waiting (os-svc-tyi-handler-path2 (os))

Event: Disable not-tm-waiting-os-svc-tyi-handler-path2.

Theorem: good-os-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-os (os-svc-tyi-handler-path2 (os))

Event: Disable good-os-os-svc-tyi-handler-path2.

Theorem: good-tm-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))))

→ good-tm (os-svc-tyi-handler-path3 (os))

Event: Disable good-tm-os-svc-tyi-handler-path3.

Theorem: tm-slimit-os-svc-tyi-handler-path3 tm-slimit (os-svc-tyi-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyi-handler-path3.

Theorem: os-code-os-svc-tyi-handler-path3 good-tm (os) → (os-code (os-svc-tyi-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyi-handler-path3.

Theorem: tm-interrupt-addresses-os-svc-tyi-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyi-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyi-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyi-handler-path3 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-tyi-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyi-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyi-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyi-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-svc-tyi-handler-path3 ¬ tm-in-supervisor-mode (os-svc-tyi-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyi-handler-path3.

Theorem: os-task-table-os-svc-tyi-handler-path3 good-tm (os) → (os-task-table (os-svc-tyi-handler-path3 (os))

= os-task-table-with-delivered-character (os))

Event: Disable os-task-table-os-svc-tyi-handler-path3.

Theorem: good-cpu-list-os-task-table-with-delivered-character (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))

→ good-cpu-list (table ('9, os-task-table-with-delivered-character (os)))

Event: Disable good-cpu-list-os-task-table-with-delivered-character.

Theorem: os-segment-table-os-svc-tyi-handler-path3 good-tm (os) → (os-segment-table (os-svc-tyi-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyi-handler-path3.

Theorem: os-readyq-os-svc-tyi-handler-path3 good-tm (os) → (os-readyq (os-svc-tyi-handler-path3 (os)) = os-readyq (os))

Event: Disable os-readyq-os-svc-tyi-handler-path3.

Theorem: os-ibuffers-os-svc-tyi-handler-path3 good-tm (os) → (os-ibuffers (os-svc-tyi-handler-path3 (os))

= os-ibuffers-with-dequeued-character (os))

Event: Disable os-ibuffers-os-svc-tyi-handler-path3.

Theorem: finite-number-queue-listp-os-ibuffers-with-dequeued-character (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers-with-dequeued-character (os)),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-with-dequeued-character.

Theorem: os-obuffers-os-svc-tyi-handler-path3 good-tm (os) → (os-obuffers (os-svc-tyi-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-tyi-handler-path3.

Theorem: os-mbuffers-os-svc-tyi-handler-path3 good-tm (os) → (os-mbuffers (os-svc-tyi-handler-path3 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyi-handler-path3.

Theorem: os-status-table-os-svc-tyi-handler-path3 good-tm (os) → (os-status-table (os-svc-tyi-handler-path3 (os))

= os-status-table (os))

Event: Disable os-status-table-os-svc-tyi-handler-path3.

Theorem: not-tm-waiting-os-svc-tyi-handler-path3 ¬ tm-waiting (os-svc-tyi-handler-path3 (os))

Event: Disable not-tm-waiting-os-svc-tyi-handler-path3.

Theorem: tm-base-os-svc-tyi-handler-path3 tm-base (os-svc-tyi-handler-path3 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-tyi-handler-path3.

Theorem: tm-limit-os-svc-tyi-handler-path3 tm-limit (os-svc-tyi-handler-path3 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-tyi-handler-path3.

Theorem: tm-base-tm-limit-os-svc-tyi-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-svc-tyi-handler-path3 (os))

= base (getnth (os-current-taskid (os-svc-tyi-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-tyi-handler-path3 (os))

= limit (getnth (os-current-taskid (os-svc-tyi-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-tyi-handler-path3.

Theorem: good-os-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))))

→ good-os (os-svc-tyi-handler-path3 (os))

Event: Disable good-os-os-svc-tyi-handler-path3.

Theorem: good-os-os-svc-tyi-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '3)))) → good-os (os-svc-tyi-handler (os))

Event: Disable good-os-os-svc-tyi-handler.

Theorem: good-tm-os-intended-svc-tyo-interrupt (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-tm (os-intended-svc-tyo-interrupt (os))

Event: Disable good-tm-os-intended-svc-tyo-interrupt.

Theorem: good-tm-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-tm (os-svc-tyo-handler-path1 (os))

Event: Disable good-tm-os-svc-tyo-handler-path1.

Theorem: tm-slimit-os-svc-tyo-handler-path1 tm-slimit (os-svc-tyo-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyo-handler-path1.

Theorem: os-code-os-svc-tyo-handler-path1 good-tm (os) → (os-code (os-svc-tyo-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyo-handler-path1.

Theorem: tm-interrupt-addresses-os-svc-tyo-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyo-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyo-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyo-handler-path1 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-tyo-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyo-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyo-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyo-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-svc-tyo-handler-path1 ¬ tm-in-supervisor-mode (os-svc-tyo-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyo-handler-path1.

Theorem: os-task-table-os-svc-tyo-handler-path1 good-tm (os) → (os-task-table (os-svc-tyo-handler-path1 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-tyo-handler-path1.

Theorem: os-segment-table-os-svc-tyo-handler-path1 good-tm (os) → (os-segment-table (os-svc-tyo-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyo-handler-path1.

Theorem: os-readyq-os-svc-tyo-handler-path1 good-tm (os) → (os-readyq (os-svc-tyo-handler-path1 (os)) = array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-tyo-handler-path1.

Theorem: os-ibuffers-os-svc-tyo-handler-path1 good-tm (os) → (os-ibuffers (os-svc-tyo-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-tyo-handler-path1.

Theorem: os-obuffers-os-svc-tyo-handler-path1 good-tm (os) → (os-obuffers (os-svc-tyo-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-tyo-handler-path1.

Theorem: os-mbuffers-os-svc-tyo-handler-path1 good-tm (os) → (os-mbuffers (os-svc-tyo-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyo-handler-path1.

Theorem: os-status-table-os-svc-tyo-handler-path1 good-tm (os) → (os-status-table (os-svc-tyo-handler-path1 (os))

= os-update-status (array-qfirst (os-readyq (os)), '4, '0, os))

Event: Disable os-status-table-os-svc-tyo-handler-path1.

Theorem: os-ready-set-os-svc-tyo-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-tyo-handler-path1 (os))

= index-ready-set ('0,

putnth ('(4 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-tyo-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-tyo-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-tyo-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-tyo-handler-path1.

Theorem: tm-waiting-os-svc-tyo-handler-path1 tm-waiting (os-svc-tyo-handler-path1 (os))

Event: Disable tm-waiting-os-svc-tyo-handler-path1.

Theorem: good-os-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ good-os (os-svc-tyo-handler-path1 (os))

Event: Disable good-os-os-svc-tyo-handler-path1.

Theorem: good-tm-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-tm (os-svc-tyo-handler-path2 (os))

Event: Disable good-tm-os-svc-tyo-handler-path2.

Theorem: tm-slimit-os-svc-tyo-handler-path2 tm-slimit (os-svc-tyo-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyo-handler-path2.

Theorem: os-code-os-svc-tyo-handler-path2 good-tm (os) → (os-code (os-svc-tyo-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyo-handler-path2.

Theorem: tm-interrupt-addresses-os-svc-tyo-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyo-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyo-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyo-handler-path2 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-tyo-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyo-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyo-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyo-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-svc-tyo-handler-path2 ¬ tm-in-supervisor-mode (os-svc-tyo-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyo-handler-path2.

Theorem: os-task-table-os-svc-tyo-handler-path2 good-tm (os) → (os-task-table (os-svc-tyo-handler-path2 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-tyo-handler-path2.

Theorem: os-segment-table-os-svc-tyo-handler-path2 good-tm (os) → (os-segment-table (os-svc-tyo-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyo-handler-path2.

Theorem: os-readyq-os-svc-tyo-handler-path2 good-tm (os) → (os-readyq (os-svc-tyo-handler-path2 (os)) = array-deq (os-readyq (os)))

Event: Disable os-readyq-os-svc-tyo-handler-path2.

Theorem: os-ibuffers-os-svc-tyo-handler-path2 good-tm (os) → (os-ibuffers (os-svc-tyo-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-tyo-handler-path2.

Theorem: os-obuffers-os-svc-tyo-handler-path2 good-tm (os) → (os-obuffers (os-svc-tyo-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-svc-tyo-handler-path2.

Theorem: os-mbuffers-os-svc-tyo-handler-path2 good-tm (os) → (os-mbuffers (os-svc-tyo-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyo-handler-path2.

Theorem: os-status-table-os-svc-tyo-handler-path2 good-tm (os) → (os-status-table (os-svc-tyo-handler-path2 (os))

= os-update-status (array-qfirst (os-readyq (os)), '4, '0, os))

Event: Disable os-status-table-os-svc-tyo-handler-path2.

Theorem: os-ready-set-os-svc-tyo-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (os-ready-set (os-svc-tyo-handler-path2 (os))

= index-ready-set ('0,

putnth ('(4 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-svc-tyo-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-svc-tyo-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → permutation (mapup-queue (array-deq (os-readyq (os))),

os-ready-set (os-svc-tyo-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-svc-tyo-handler-path2.

Theorem: tm-base-os-svc-tyo-handler-path2 tm-base (os-svc-tyo-handler-path2 (os)) = os-new-base (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-base-os-svc-tyo-handler-path2.

Theorem: tm-limit-os-svc-tyo-handler-path2 tm-limit (os-svc-tyo-handler-path2 (os)) = os-new-limit (array-qfirst (array-deq (os-readyq (os))), os)

Event: Disable tm-limit-os-svc-tyo-handler-path2.

Theorem: tm-base-tm-limit-os-svc-tyo-handler-path2 good-tm (os) → ((tm-base (os-svc-tyo-handler-path2 (os))

= base (getnth (os-current-taskid (os-svc-tyo-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-tyo-handler-path2 (os))

= limit (getnth (os-current-taskid (os-svc-tyo-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-tyo-handler-path2.

Theorem: not-tm-waiting-os-svc-tyo-handler-path2 ¬ tm-waiting (os-svc-tyo-handler-path2 (os))

Event: Disable not-tm-waiting-os-svc-tyo-handler-path2.

Theorem: good-os-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ good-os (os-svc-tyo-handler-path2 (os))

Event: Disable good-os-os-svc-tyo-handler-path2.

Theorem: good-tm-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os)))))))

→ good-tm (os-svc-tyo-handler-path3 (os))

Event: Disable good-tm-os-svc-tyo-handler-path3.

Theorem: tm-slimit-os-svc-tyo-handler-path3 tm-slimit (os-svc-tyo-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyo-handler-path3.

Theorem: os-code-os-svc-tyo-handler-path3 good-tm (os) → (os-code (os-svc-tyo-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyo-handler-path3.

Theorem: tm-interrupt-addresses-os-svc-tyo-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyo-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyo-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyo-handler-path3 (os)))

= getnth ('5, tm-memory (os)))

∧ ((getnth ('6,

tm-memory (os-svc-tyo-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyo-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyo-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyo-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-svc-tyo-handler-path3 ¬ tm-in-supervisor-mode (os-svc-tyo-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyo-handler-path3.

Theorem: os-task-table-os-svc-tyo-handler-path3 good-tm (os) → (os-task-table (os-svc-tyo-handler-path3 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-tyo-handler-path3.

Theorem: os-segment-table-os-svc-tyo-handler-path3 good-tm (os) → (os-segment-table (os-svc-tyo-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyo-handler-path3.

Theorem: os-readyq-os-svc-tyo-handler-path3 good-tm (os) → (os-readyq (os-svc-tyo-handler-path3 (os)) = os-readyq (os))

Event: Disable os-readyq-os-svc-tyo-handler-path3.

Theorem: os-ibuffers-os-svc-tyo-handler-path3 good-tm (os) → (os-ibuffers (os-svc-tyo-handler-path3 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-tyo-handler-path3.

Theorem: os-obuffers-os-svc-tyo-handler-path3 good-tm (os) → (os-obuffers (os-svc-tyo-handler-path3 (os))

= os-obuffers-with-enqueued-character (os))

Event: Disable os-obuffers-os-svc-tyo-handler-path3.

Theorem: finite-number-queue-listp-os-obuffers-with-enqueued-character (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-obuffer (os-current-taskid (os), os)))))

→ finite-number-queue-listp (table ('8,

os-obuffers-with-enqueued-character (os)),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-obuffers-with-enqueued-character.

Theorem: os-mbuffers-os-svc-tyo-handler-path3 good-tm (os) → (os-mbuffers (os-svc-tyo-handler-path3 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyo-handler-path3.

Theorem: os-status-table-os-svc-tyo-handler-path3 good-tm (os) → (os-status-table (os-svc-tyo-handler-path3 (os))

= os-status-table (os))

Event: Disable os-status-table-os-svc-tyo-handler-path3.

Theorem: not-tm-waiting-os-svc-tyo-handler-path3 ¬ tm-waiting (os-svc-tyo-handler-path3 (os))

Event: Disable not-tm-waiting-os-svc-tyo-handler-path3.

Theorem: tm-base-os-svc-tyo-handler-path3 tm-base (os-svc-tyo-handler-path3 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-tyo-handler-path3.

Theorem: tm-limit-os-svc-tyo-handler-path3 tm-limit (os-svc-tyo-handler-path3 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-tyo-handler-path3.

Theorem: tm-base-tm-limit-os-svc-tyo-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-svc-tyo-handler-path3 (os))

= base (getnth (os-current-taskid (os-svc-tyo-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-tyo-handler-path3 (os))

= limit (getnth (os-current-taskid (os-svc-tyo-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-tyo-handler-path3.

Theorem: good-os-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os)))))))

→ good-os (os-svc-tyo-handler-path3 (os))

Event: Disable good-os-os-svc-tyo-handler-path3.

Theorem: good-tm-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ (¬ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os))))))))

→ good-tm (os-svc-tyo-handler-path4 (os))

Event: Disable good-tm-os-svc-tyo-handler-path4.

Theorem: tm-slimit-os-svc-tyo-handler-path4 tm-slimit (os-svc-tyo-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-svc-tyo-handler-path4.

Theorem: os-code-os-svc-tyo-handler-path4 good-tm (os) → (os-code (os-svc-tyo-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-svc-tyo-handler-path4.

Theorem: tm-interrupt-addresses-os-svc-tyo-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-svc-tyo-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-svc-tyo-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5, tm-memory (os-svc-tyo-handler-path4 (os)))

= getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-svc-tyo-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-svc-tyo-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-svc-tyo-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-svc-tyo-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-svc-tyo-handler-path4 ¬ tm-in-supervisor-mode (os-svc-tyo-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-svc-tyo-handler-path4.

Theorem: os-task-table-os-svc-tyo-handler-path4 good-tm (os) → (os-task-table (os-svc-tyo-handler-path4 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-svc-tyo-handler-path4.

Theorem: os-segment-table-os-svc-tyo-handler-path4 good-tm (os) → (os-segment-table (os-svc-tyo-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-svc-tyo-handler-path4.

Theorem: os-readyq-os-svc-tyo-handler-path4 good-tm (os) → (os-readyq (os-svc-tyo-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-svc-tyo-handler-path4.

Theorem: os-ibuffers-os-svc-tyo-handler-path4 good-tm (os) → (os-ibuffers (os-svc-tyo-handler-path4 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-svc-tyo-handler-path4.

Theorem: os-obuffers-os-svc-tyo-handler-path4 good-tm (os) → (os-obuffers (os-svc-tyo-handler-path4 (os))

= os-obuffers-with-enqueued-character (os))

Event: Disable os-obuffers-os-svc-tyo-handler-path4.

Theorem: os-mbuffers-os-svc-tyo-handler-path4 good-tm (os) → (os-mbuffers (os-svc-tyo-handler-path4 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-svc-tyo-handler-path4.

Theorem: os-status-table-os-svc-tyo-handler-path4 good-tm (os) → (os-status-table (os-svc-tyo-handler-path4 (os))

= os-status-table (os))

Event: Disable os-status-table-os-svc-tyo-handler-path4.

Theorem: not-tm-waiting-os-svc-tyo-handler-path4 ¬ tm-waiting (os-svc-tyo-handler-path4 (os))

Event: Disable not-tm-waiting-os-svc-tyo-handler-path4.

Theorem: tm-base-os-svc-tyo-handler-path4 tm-base (os-svc-tyo-handler-path4 (os)) = tm-base (os)

Event: Disable tm-base-os-svc-tyo-handler-path4.

Theorem: tm-limit-os-svc-tyo-handler-path4 tm-limit (os-svc-tyo-handler-path4 (os)) = tm-limit (os)

Event: Disable tm-limit-os-svc-tyo-handler-path4.

Theorem: tm-base-tm-limit-os-svc-tyo-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-svc-tyo-handler-path4 (os))

= base (getnth (os-current-taskid (os-svc-tyo-handler-path4 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-svc-tyo-handler-path4 (os))

= limit (getnth (os-current-taskid (os-svc-tyo-handler-path4 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-svc-tyo-handler-path4.

Theorem: good-os-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ (¬ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os))))))))

→ good-os (os-svc-tyo-handler-path4 (os))

Event: Disable good-os-os-svc-tyo-handler-path4.

Theorem: good-os-os-svc-tyo-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '2)))) → good-os (os-svc-tyo-handler (os))

Event: Disable good-os-os-svc-tyo-handler.

Theorem: good-tm-os-intended-input-interrupt (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-tm (os-intended-input-interrupt (os))

Event: Disable good-tm-os-intended-input-interrupt.

Theorem: finite-number-queuep-array-enq-interrupting-input-port (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → finite-number-queuep (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os)),

                       '16,
                       '16)

Event: Disable finite-number-queuep-array-enq-interrupting-input-port.

Theorem: good-tm-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-tm (os-waiting-input-handler-path1 (os))

Event: Disable good-tm-os-waiting-input-handler-path1.

Theorem: tm-slimit-os-waiting-input-handler-path1 tm-slimit (os-waiting-input-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-input-handler-path1.

Theorem: os-code-os-waiting-input-handler-path1 good-tm (os) → (os-code (os-waiting-input-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-waiting-input-handler-path1.

Theorem: tm-interrupt-addresses-os-waiting-input-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-input-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-input-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-input-handler-path1 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-input-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-input-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-input-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-input-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-waiting-input-handler-path1 ¬ tm-in-supervisor-mode (os-waiting-input-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-input-handler-path1.

Theorem: os-task-table-os-waiting-input-handler-path1 good-tm (os) → (os-task-table (os-waiting-input-handler-path1 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-input-handler-path1.

Theorem: os-segment-table-os-waiting-input-handler-path1 good-tm (os) → (os-segment-table (os-waiting-input-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-input-handler-path1.

Theorem: os-readyq-os-waiting-input-handler-path1 good-tm (os) → (os-readyq (os-waiting-input-handler-path1 (os))

= array-enq (tm-interrupting-input-port (tm-iports (os)), os-readyq (os)))

Event: Disable os-readyq-os-waiting-input-handler-path1.

Theorem: os-ibuffers-os-waiting-input-handler-path1 good-tm (os) → (os-ibuffers (os-waiting-input-handler-path1 (os))

= os-ibuffers-with-qreplaced-overflow-character (os))

Event: Disable os-ibuffers-os-waiting-input-handler-path1.

Theorem: finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-waiting-input-handler-path1 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path1.

Theorem: os-obuffers-os-waiting-input-handler-path1 good-tm (os) → (os-obuffers (os-waiting-input-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-input-handler-path1.

Theorem: os-mbuffers-os-waiting-input-handler-path1 good-tm (os) → (os-mbuffers (os-waiting-input-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-input-handler-path1.

Theorem: os-status-table-os-waiting-input-handler-path1 good-tm (os) → (os-status-table (os-waiting-input-handler-path1 (os))

= os-update-status (tm-interrupting-input-port (tm-iports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-waiting-input-handler-path1.

Theorem: good-status-list-os-status-table-os-waiting-input-handler-path1 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-status-list (table ('2,

os-status-table (os-waiting-input-handler-path1 (os))))

Event: Disable good-status-list-os-status-table-os-waiting-input-handler-path1.

Theorem: os-ready-set-os-waiting-input-handler-path1 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (os-ready-set (os-waiting-input-handler-path1 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-waiting-input-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ permutation (mapup-queue (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os))),

os-ready-set (os-waiting-input-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-waiting-input-handler-path1.

Theorem: not-tm-waiting-os-waiting-input-handler-path1 ¬ tm-waiting (os-waiting-input-handler-path1 (os))

Event: Disable not-tm-waiting-os-waiting-input-handler-path1.

Theorem: tm-base-os-waiting-input-handler-path1 tm-base (os-waiting-input-handler-path1 (os)) = base (getnth (tm-interrupting-input-port (tm-iports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-base-os-waiting-input-handler-path1.

Theorem: tm-limit-os-waiting-input-handler-path1 tm-limit (os-waiting-input-handler-path1 (os)) = limit (getnth (tm-interrupting-input-port (tm-iports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-limit-os-waiting-input-handler-path1.

Theorem: tm-base-tm-limit-os-waiting-input-handler-path1 (good-os (os) ∧ tm-waiting (os)) → ((tm-base (os-waiting-input-handler-path1 (os))

= base (getnth (os-current-taskid (os-waiting-input-handler-path1 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-waiting-input-handler-path1 (os))

= limit (getnth (os-current-taskid (os-waiting-input-handler-path1 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-waiting-input-handler-path1.

Theorem: good-os-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-os (os-waiting-input-handler-path1 (os))

Event: Disable good-os-os-waiting-input-handler-path1.

Theorem: good-tm-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-tm (os-waiting-input-handler-path2 (os))

Event: Disable good-tm-os-waiting-input-handler-path2.

Theorem: tm-slimit-os-waiting-input-handler-path2 tm-slimit (os-waiting-input-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-input-handler-path2.

Theorem: os-code-os-waiting-input-handler-path2 good-tm (os) → (os-code (os-waiting-input-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-waiting-input-handler-path2.

Theorem: tm-interrupt-addresses-os-waiting-input-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-input-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-input-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-input-handler-path2 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-input-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-input-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-input-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-input-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-waiting-input-handler-path2 ¬ tm-in-supervisor-mode (os-waiting-input-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-input-handler-path2.

Theorem: os-task-table-os-waiting-input-handler-path2 good-tm (os) → (os-task-table (os-waiting-input-handler-path2 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-input-handler-path2.

Theorem: os-segment-table-os-waiting-input-handler-path2 good-tm (os) → (os-segment-table (os-waiting-input-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-input-handler-path2.

Theorem: os-readyq-os-waiting-input-handler-path2 good-tm (os) → (os-readyq (os-waiting-input-handler-path2 (os))

= array-enq (tm-interrupting-input-port (tm-iports (os)), os-readyq (os)))

Event: Disable os-readyq-os-waiting-input-handler-path2.

Theorem: os-ibuffers-os-waiting-input-handler-path2 good-tm (os) → (os-ibuffers (os-waiting-input-handler-path2 (os))

= os-ibuffers-with-enqueued-overflow-character (os))

Event: Disable os-ibuffers-os-waiting-input-handler-path2.

Theorem: finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-waiting-input-handler-path2 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path2.

Theorem: os-obuffers-os-waiting-input-handler-path2 good-tm (os) → (os-obuffers (os-waiting-input-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-input-handler-path2.

Theorem: os-mbuffers-os-waiting-input-handler-path2 good-tm (os) → (os-mbuffers (os-waiting-input-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-input-handler-path2.

Theorem: os-status-table-os-waiting-input-handler-path2 good-tm (os)

→ (os-status-table (os-waiting-input-handler-path2 (os))

= os-update-status (tm-interrupting-input-port (tm-iports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-waiting-input-handler-path2.

Theorem: good-status-list-os-status-table-os-waiting-input-handler-path2 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-status-list (table ('2,

os-status-table (os-waiting-input-handler-path2 (os))))

Event: Disable good-status-list-os-status-table-os-waiting-input-handler-path2.

Theorem: os-ready-set-os-waiting-input-handler-path2 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (os-ready-set (os-waiting-input-handler-path2 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-waiting-input-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ permutation (mapup-queue (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os))),

os-ready-set (os-waiting-input-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-waiting-input-handler-path2.

Theorem: not-tm-waiting-os-waiting-input-handler-path2 ¬ tm-waiting (os-waiting-input-handler-path2 (os))

Event: Disable not-tm-waiting-os-waiting-input-handler-path2.

Theorem: tm-base-os-waiting-input-handler-path2 tm-base (os-waiting-input-handler-path2 (os)) = base (getnth (tm-interrupting-input-port (tm-iports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-base-os-waiting-input-handler-path2.

Theorem: tm-limit-os-waiting-input-handler-path2 tm-limit (os-waiting-input-handler-path2 (os)) = limit (getnth (tm-interrupting-input-port (tm-iports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-limit-os-waiting-input-handler-path2.

Theorem: tm-base-tm-limit-os-waiting-input-handler-path2 (good-os (os) ∧ tm-waiting (os)) → ((tm-base (os-waiting-input-handler-path2 (os))

= base (getnth (os-current-taskid (os-waiting-input-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-waiting-input-handler-path2 (os))

= limit (getnth (os-current-taskid (os-waiting-input-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-waiting-input-handler-path2.

Theorem: good-os-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-os (os-waiting-input-handler-path2 (os))

Event: Disable good-os-os-waiting-input-handler-path2.

Theorem: good-tm-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-tm (os-waiting-input-handler-path3 (os))

Event: Disable good-tm-os-waiting-input-handler-path3.

Theorem: tm-slimit-os-waiting-input-handler-path3 tm-slimit (os-waiting-input-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-input-handler-path3.

Theorem: os-code-os-waiting-input-handler-path3 good-tm (os) → (os-code (os-waiting-input-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-waiting-input-handler-path3.

Theorem: tm-interrupt-addresses-os-waiting-input-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-input-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-input-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-input-handler-path3 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-input-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-input-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-input-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-input-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-waiting-input-handler-path3 ¬ tm-in-supervisor-mode (os-waiting-input-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-input-handler-path3.

Theorem: os-task-table-os-waiting-input-handler-path3 good-tm (os) → (os-task-table (os-waiting-input-handler-path3 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-input-handler-path3.

Theorem: os-segment-table-os-waiting-input-handler-path3 good-tm (os) → (os-segment-table (os-waiting-input-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-input-handler-path3.

Theorem: os-readyq-os-waiting-input-handler-path3 good-tm (os) → (os-readyq (os-waiting-input-handler-path3 (os))

= array-enq (tm-interrupting-input-port (tm-iports (os)), os-readyq (os)))

Event: Disable os-readyq-os-waiting-input-handler-path3.

Theorem: os-ibuffers-os-waiting-input-handler-path3 good-tm (os) → (os-ibuffers (os-waiting-input-handler-path3 (os))

= os-ibuffers-with-enqueued-character (os))

Event: Disable os-ibuffers-os-waiting-input-handler-path3.

Theorem: finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path3 (good-os (os)

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-waiting-input-handler-path3 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path3.

Theorem: os-obuffers-os-waiting-input-handler-path3 good-tm (os) → (os-obuffers (os-waiting-input-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-input-handler-path3.

Theorem: os-mbuffers-os-waiting-input-handler-path3 good-tm (os) → (os-mbuffers (os-waiting-input-handler-path3 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-input-handler-path3.

Theorem: os-status-table-os-waiting-input-handler-path3 good-tm (os) → (os-status-table (os-waiting-input-handler-path3 (os))

= os-update-status (tm-interrupting-input-port (tm-iports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-waiting-input-handler-path3.

Theorem: good-status-list-os-status-table-os-waiting-input-handler-path3 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-status-list (table ('2,

os-status-table (os-waiting-input-handler-path3 (os))))

Event: Disable good-status-list-os-status-table-os-waiting-input-handler-path3.

Theorem: os-ready-set-os-waiting-input-handler-path3 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os)))

→ (os-ready-set (os-waiting-input-handler-path3 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-waiting-input-handler-path3.

Theorem: permutation-os-readyq-os-ready-set-for-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ permutation (mapup-queue (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os))),

os-ready-set (os-waiting-input-handler-path3 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-waiting-input-handler-path3.

Theorem: not-tm-waiting-os-waiting-input-handler-path3 ¬ tm-waiting (os-waiting-input-handler-path3 (os))

Event: Disable not-tm-waiting-os-waiting-input-handler-path3.

Theorem: tm-base-os-waiting-input-handler-path3 tm-base (os-waiting-input-handler-path3 (os)) = base (getnth (tm-interrupting-input-port (tm-iports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-base-os-waiting-input-handler-path3.

Theorem: tm-limit-os-waiting-input-handler-path3 tm-limit (os-waiting-input-handler-path3 (os)) = limit (getnth (tm-interrupting-input-port (tm-iports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-limit-os-waiting-input-handler-path3.

Theorem: tm-base-tm-limit-os-waiting-input-handler-path3 (good-os (os) ∧ tm-waiting (os)) → ((tm-base (os-waiting-input-handler-path3 (os))

= base (getnth (os-current-taskid (os-waiting-input-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-waiting-input-handler-path3 (os))

= limit (getnth (os-current-taskid (os-waiting-input-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-waiting-input-handler-path3.

Theorem: good-os-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-os (os-waiting-input-handler-path3 (os))

Event: Disable good-os-os-waiting-input-handler-path3.

Theorem: good-tm-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-tm (os-waiting-input-handler-path4 (os))

Event: Disable good-tm-os-waiting-input-handler-path4.

Theorem: tm-slimit-os-waiting-input-handler-path4 tm-slimit (os-waiting-input-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-input-handler-path4.

Theorem: os-code-os-waiting-input-handler-path4 good-tm (os) → (os-code (os-waiting-input-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-waiting-input-handler-path4.

Theorem: tm-interrupt-addresses-os-waiting-input-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-input-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-input-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-input-handler-path4 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-input-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-input-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-input-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-input-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-waiting-input-handler-path4 ¬ tm-in-supervisor-mode (os-waiting-input-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-input-handler-path4.

Theorem: os-task-table-os-waiting-input-handler-path4 good-tm (os) → (os-task-table (os-waiting-input-handler-path4 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-input-handler-path4.

Theorem: os-segment-table-os-waiting-input-handler-path4 good-tm (os) → (os-segment-table (os-waiting-input-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-input-handler-path4.

Theorem: os-readyq-os-waiting-input-handler-path4 good-tm (os) → (os-readyq (os-waiting-input-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-waiting-input-handler-path4.

Theorem: os-ibuffers-os-waiting-input-handler-path4 good-tm (os) → (os-ibuffers (os-waiting-input-handler-path4 (os))

= os-ibuffers-with-qreplaced-overflow-character (os))

Event: Disable os-ibuffers-os-waiting-input-handler-path4.

Theorem: finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-waiting-input-handler-path4 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path4.

Theorem: os-obuffers-os-waiting-input-handler-path4 good-tm (os) → (os-obuffers (os-waiting-input-handler-path4 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-input-handler-path4.

Theorem: os-mbuffers-os-waiting-input-handler-path4 good-tm (os) → (os-mbuffers (os-waiting-input-handler-path4 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-input-handler-path4.

Theorem: os-status-table-os-waiting-input-handler-path4 good-tm (os)

→ (os-status-table (os-waiting-input-handler-path4 (os)) = os-status-table (os))

Event: Disable os-status-table-os-waiting-input-handler-path4.

Theorem: tm-waiting-os-waiting-input-handler-path4 tm-waiting (os-waiting-input-handler-path4 (os))

Event: Disable tm-waiting-os-waiting-input-handler-path4.

Theorem: good-os-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-os (os-waiting-input-handler-path4 (os))

Event: Disable good-os-os-waiting-input-handler-path4.

Theorem: good-tm-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-tm (os-waiting-input-handler-path5 (os))

Event: Disable good-tm-os-waiting-input-handler-path5.

Theorem: tm-slimit-os-waiting-input-handler-path5 tm-slimit (os-waiting-input-handler-path5 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-input-handler-path5.

Theorem: os-code-os-waiting-input-handler-path5 good-tm (os) → (os-code (os-waiting-input-handler-path5 (os)) = os-code (os))

Event: Disable os-code-os-waiting-input-handler-path5.

Theorem: tm-interrupt-addresses-os-waiting-input-handler-path5 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-input-handler-path5 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-input-handler-path5 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-input-handler-path5 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-input-handler-path5 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-input-handler-path5 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-input-handler-path5 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-input-handler-path5.

Theorem: not-tm-in-supervisor-mode-os-waiting-input-handler-path5 ¬ tm-in-supervisor-mode (os-waiting-input-handler-path5 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-input-handler-path5.

Theorem: os-task-table-os-waiting-input-handler-path5 good-tm (os) → (os-task-table (os-waiting-input-handler-path5 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-input-handler-path5.

Theorem: os-segment-table-os-waiting-input-handler-path5 good-tm (os) → (os-segment-table (os-waiting-input-handler-path5 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-input-handler-path5.

Theorem: os-readyq-os-waiting-input-handler-path5 good-tm (os) → (os-readyq (os-waiting-input-handler-path5 (os)) = os-readyq (os))

Event: Disable os-readyq-os-waiting-input-handler-path5.

Theorem: os-ibuffers-os-waiting-input-handler-path5 good-tm (os) → (os-ibuffers (os-waiting-input-handler-path5 (os))

= os-ibuffers-with-enqueued-overflow-character (os))

Event: Disable os-ibuffers-os-waiting-input-handler-path5.

Theorem: finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-waiting-input-handler-path5 (os))),

                          '4,
                          '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path5.

Theorem: os-obuffers-os-waiting-input-handler-path5 good-tm (os) → (os-obuffers (os-waiting-input-handler-path5 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-input-handler-path5.

Theorem: os-mbuffers-os-waiting-input-handler-path5 good-tm (os) → (os-mbuffers (os-waiting-input-handler-path5 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-input-handler-path5.

Theorem: os-status-table-os-waiting-input-handler-path5 good-tm (os) → (os-status-table (os-waiting-input-handler-path5 (os))

= os-status-table (os))

Event: Disable os-status-table-os-waiting-input-handler-path5.

Theorem: tm-waiting-os-waiting-input-handler-path5 tm-waiting (os-waiting-input-handler-path5 (os))

Event: Disable tm-waiting-os-waiting-input-handler-path5.

Theorem: good-os-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-os (os-waiting-input-handler-path5 (os))

Event: Disable good-os-os-waiting-input-handler-path5.

Theorem: good-tm-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-tm (os-waiting-input-handler-path6 (os))

Event: Disable good-tm-os-waiting-input-handler-path6.

Theorem: tm-slimit-os-waiting-input-handler-path6 tm-slimit (os-waiting-input-handler-path6 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-input-handler-path6.

Theorem: os-code-os-waiting-input-handler-path6 good-tm (os) → (os-code (os-waiting-input-handler-path6 (os)) = os-code (os))

Event: Disable os-code-os-waiting-input-handler-path6.

Theorem: tm-interrupt-addresses-os-waiting-input-handler-path6 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-input-handler-path6 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-input-handler-path6 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-input-handler-path6 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-input-handler-path6 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-input-handler-path6 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-input-handler-path6 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-input-handler-path6.

Theorem: not-tm-in-supervisor-mode-os-waiting-input-handler-path6 ¬ tm-in-supervisor-mode (os-waiting-input-handler-path6 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-input-handler-path6.

Theorem: os-task-table-os-waiting-input-handler-path6 good-tm (os) → (os-task-table (os-waiting-input-handler-path6 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-input-handler-path6.

Theorem: os-segment-table-os-waiting-input-handler-path6 good-tm (os) → (os-segment-table (os-waiting-input-handler-path6 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-input-handler-path6.

Theorem: os-readyq-os-waiting-input-handler-path6 good-tm (os) → (os-readyq (os-waiting-input-handler-path6 (os)) = os-readyq (os))

Event: Disable os-readyq-os-waiting-input-handler-path6.

Theorem: os-ibuffers-os-waiting-input-handler-path6 good-tm (os) → (os-ibuffers (os-waiting-input-handler-path6 (os))

= os-ibuffers-with-enqueued-character (os))

Event: Disable os-ibuffers-os-waiting-input-handler-path6.

Theorem: finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-waiting-input-handler-path6 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-waiting-input-handler-path6.

Theorem: os-obuffers-os-waiting-input-handler-path6 good-tm (os) → (os-obuffers (os-waiting-input-handler-path6 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-input-handler-path6.

Theorem: os-mbuffers-os-waiting-input-handler-path6 good-tm (os) → (os-mbuffers (os-waiting-input-handler-path6 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-input-handler-path6.

Theorem: os-status-table-os-waiting-input-handler-path6 good-tm (os) → (os-status-table (os-waiting-input-handler-path6 (os))

= os-status-table (os))

Event: Disable os-status-table-os-waiting-input-handler-path6.

Theorem: tm-waiting-os-waiting-input-handler-path6 tm-waiting (os-waiting-input-handler-path6 (os))

Event: Disable tm-waiting-os-waiting-input-handler-path6.

Theorem: good-os-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-os (os-waiting-input-handler-path6 (os))

Event: Disable good-os-os-waiting-input-handler-path6.

Theorem: good-os-os-waiting-input-handler (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → good-os (os-waiting-input-handler (os))

Event: Disable good-os-os-waiting-input-handler.

Theorem: finite-number-queuep-array-enq-interrupting-input-port2 (good-os (os)

∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ finite-number-queuep (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os)),

                       '16,
                       '16)

Event: Disable finite-number-queuep-array-enq-interrupting-input-port2.

Theorem: good-tm-os-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-tm (os-running-input-handler-path1 (os))

Event: Disable good-tm-os-running-input-handler-path1.

Theorem: tm-slimit-os-running-input-handler-path1 tm-slimit (os-running-input-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-input-handler-path1.

Theorem: os-code-os-running-input-handler-path1 good-tm (os) → (os-code (os-running-input-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-running-input-handler-path1.

Theorem: tm-interrupt-addresses-os-running-input-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-running-input-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-input-handler-path1 (os)))

= getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-input-handler-path1 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-input-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-input-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-input-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-input-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-running-input-handler-path1 ¬ tm-in-supervisor-mode (os-running-input-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-input-handler-path1.

Theorem: os-task-table-os-running-input-handler-path1 good-tm (os) → (os-task-table (os-running-input-handler-path1 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-input-handler-path1.

Theorem: os-segment-table-os-running-input-handler-path1 good-tm (os) → (os-segment-table (os-running-input-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-input-handler-path1.

Theorem: os-readyq-os-running-input-handler-path1 good-tm (os) → (os-readyq (os-running-input-handler-path1 (os))

= array-enq (tm-interrupting-input-port (tm-iports (os)), os-readyq (os)))

Event: Disable os-readyq-os-running-input-handler-path1.

Theorem: os-ibuffers-os-running-input-handler-path1 good-tm (os) → (os-ibuffers (os-running-input-handler-path1 (os))

= os-ibuffers-with-qreplaced-overflow-character (os))

Event: Disable os-ibuffers-os-running-input-handler-path1.

Theorem: finite-number-queue-listp-os-ibuffers-os-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-running-input-handler-path1 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-running-input-handler-path1.

Theorem: os-obuffers-os-running-input-handler-path1 good-tm (os) → (os-obuffers (os-running-input-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-input-handler-path1.

Theorem: os-mbuffers-os-running-input-handler-path1 good-tm (os) → (os-mbuffers (os-running-input-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-input-handler-path1.

Theorem: os-status-table-os-running-input-handler-path1 good-tm (os) → (os-status-table (os-running-input-handler-path1 (os))

= os-update-status (tm-interrupting-input-port (tm-iports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-running-input-handler-path1.

Theorem: good-status-list-os-status-table-os-running-input-handler-path1 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-status-list (table ('2,

os-status-table (os-running-input-handler-path1 (os))))

Event: Disable good-status-list-os-status-table-os-running-input-handler-path1.

Theorem: os-ready-set-os-running-input-handler-path1 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (os-ready-set (os-running-input-handler-path1 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-running-input-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ permutation (mapup-queue (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os))),

os-ready-set (os-running-input-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-running-input-handler-path1.

Theorem: not-tm-waiting-os-running-input-handler-path1 ¬ tm-waiting (os-running-input-handler-path1 (os))

Event: Disable not-tm-waiting-os-running-input-handler-path1.

Theorem: tm-base-os-running-input-handler-path1 tm-base (os-running-input-handler-path1 (os)) = tm-base (os)

Event: Disable tm-base-os-running-input-handler-path1.

Theorem: tm-limit-os-running-input-handler-path1 tm-limit (os-running-input-handler-path1 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-input-handler-path1.

Theorem: tm-base-tm-limit-os-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ ((tm-base (os-running-input-handler-path1 (os))

= base (getnth (os-current-taskid (os-running-input-handler-path1 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-input-handler-path1 (os))

= limit (getnth (os-current-taskid (os-running-input-handler-path1 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-input-handler-path1.

Theorem: good-os-os-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-os (os-running-input-handler-path1 (os))

Event: Disable good-os-os-running-input-handler-path1.

Theorem: good-tm-os-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-tm (os-running-input-handler-path2 (os))

Event: Disable good-tm-os-running-input-handler-path2.

Theorem: tm-slimit-os-running-input-handler-path2 tm-slimit (os-running-input-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-input-handler-path2.

Theorem: os-code-os-running-input-handler-path2 good-tm (os) → (os-code (os-running-input-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-running-input-handler-path2.

Theorem: tm-interrupt-addresses-os-running-input-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-running-input-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-input-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-input-handler-path2 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-input-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-input-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-input-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-input-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-running-input-handler-path2 ¬ tm-in-supervisor-mode (os-running-input-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-input-handler-path2.

Theorem: os-task-table-os-running-input-handler-path2 good-tm (os) → (os-task-table (os-running-input-handler-path2 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-input-handler-path2.

Theorem: os-segment-table-os-running-input-handler-path2 good-tm (os) → (os-segment-table (os-running-input-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-input-handler-path2.

Theorem: os-readyq-os-running-input-handler-path2 good-tm (os) → (os-readyq (os-running-input-handler-path2 (os))

= array-enq (tm-interrupting-input-port (tm-iports (os)), os-readyq (os)))

Event: Disable os-readyq-os-running-input-handler-path2.

Theorem: os-ibuffers-os-running-input-handler-path2 good-tm (os) → (os-ibuffers (os-running-input-handler-path2 (os))

= os-ibuffers-with-enqueued-overflow-character (os))

Event: Disable os-ibuffers-os-running-input-handler-path2.

Theorem: finite-number-queue-listp-os-ibuffers-os-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-running-input-handler-path2 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-running-input-handler-path2.

Theorem: os-obuffers-os-running-input-handler-path2 good-tm (os) → (os-obuffers (os-running-input-handler-path2 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-input-handler-path2.

Theorem: os-mbuffers-os-running-input-handler-path2 good-tm (os) → (os-mbuffers (os-running-input-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-input-handler-path2.

Theorem: os-status-table-os-running-input-handler-path2 good-tm (os) → (os-status-table (os-running-input-handler-path2 (os))

= os-update-status (tm-interrupting-input-port (tm-iports (os)),

                       '0,
                       '0,

os))

Event: Disable os-status-table-os-running-input-handler-path2.

Theorem: good-status-list-os-status-table-os-running-input-handler-path2 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-status-list (table ('2,

os-status-table (os-running-input-handler-path2 (os))))

Event: Disable good-status-list-os-status-table-os-running-input-handler-path2.

Theorem: os-ready-set-os-running-input-handler-path2 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (os-ready-set (os-running-input-handler-path2 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-running-input-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ permutation (mapup-queue (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os))),

os-ready-set (os-running-input-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-running-input-handler-path2.

Theorem: not-tm-waiting-os-running-input-handler-path2 ¬ tm-waiting (os-running-input-handler-path2 (os))

Event: Disable not-tm-waiting-os-running-input-handler-path2.

Theorem: tm-base-os-running-input-handler-path2 tm-base (os-running-input-handler-path2 (os)) = tm-base (os)

Event: Disable tm-base-os-running-input-handler-path2.

Theorem: tm-limit-os-running-input-handler-path2 tm-limit (os-running-input-handler-path2 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-input-handler-path2.

Theorem: tm-base-tm-limit-os-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ ((tm-base (os-running-input-handler-path2 (os))

= base (getnth (os-current-taskid (os-running-input-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-input-handler-path2 (os))

= limit (getnth (os-current-taskid (os-running-input-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-input-handler-path2.

Theorem: good-os-os-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-os (os-running-input-handler-path2 (os))

Event: Disable good-os-os-running-input-handler-path2.

Theorem: good-tm-os-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-tm (os-running-input-handler-path3 (os))

Event: Disable good-tm-os-running-input-handler-path3.

Theorem: tm-slimit-os-running-input-handler-path3 tm-slimit (os-running-input-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-input-handler-path3.

Theorem: os-code-os-running-input-handler-path3 good-tm (os) → (os-code (os-running-input-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-running-input-handler-path3.

Theorem: tm-interrupt-addresses-os-running-input-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-running-input-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-input-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-input-handler-path3 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-input-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-input-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-input-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-input-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-running-input-handler-path3 ¬ tm-in-supervisor-mode (os-running-input-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-input-handler-path3.

Theorem: os-task-table-os-running-input-handler-path3 good-tm (os) → (os-task-table (os-running-input-handler-path3 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-input-handler-path3.

Theorem: os-segment-table-os-running-input-handler-path3 good-tm (os) → (os-segment-table (os-running-input-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-input-handler-path3.

Theorem: os-readyq-os-running-input-handler-path3 good-tm (os)

→ (os-readyq (os-running-input-handler-path3 (os))

= array-enq (tm-interrupting-input-port (tm-iports (os)), os-readyq (os)))

Event: Disable os-readyq-os-running-input-handler-path3.

Theorem: os-ibuffers-os-running-input-handler-path3 good-tm (os) → (os-ibuffers (os-running-input-handler-path3 (os))

= os-ibuffers-with-enqueued-character (os))

Event: Disable os-ibuffers-os-running-input-handler-path3.

Theorem: finite-number-queue-listp-os-ibuffers-os-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-running-input-handler-path3 (os))),

                          '4,
                          '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-running-input-handler-path3.

Theorem: os-obuffers-os-running-input-handler-path3 good-tm (os) → (os-obuffers (os-running-input-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-input-handler-path3.

Theorem: os-mbuffers-os-running-input-handler-path3 good-tm (os) → (os-mbuffers (os-running-input-handler-path3 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-input-handler-path3.

Theorem: os-status-table-os-running-input-handler-path3 good-tm (os) → (os-status-table (os-running-input-handler-path3 (os))

= os-update-status (tm-interrupting-input-port (tm-iports (os)),

                        '0,

os))

Event: Disable os-status-table-os-running-input-handler-path3.

Theorem: good-status-list-os-status-table-os-running-input-handler-path3 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-status-list (table ('2,

os-status-table (os-running-input-handler-path3 (os))))

Event: Disable good-status-list-os-status-table-os-running-input-handler-path3.

Theorem: os-ready-set-os-running-input-handler-path3 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (os-ready-set (os-running-input-handler-path3 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-running-input-handler-path3.

Theorem: permutation-os-readyq-os-ready-set-for-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ permutation (mapup-queue (array-enq (tm-interrupting-input-port (tm-iports (os)),

os-readyq (os))),

os-ready-set (os-running-input-handler-path3 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-running-input-handler-path3.

Theorem: not-tm-waiting-os-running-input-handler-path3 ¬ tm-waiting (os-running-input-handler-path3 (os))

Event: Disable not-tm-waiting-os-running-input-handler-path3.

Theorem: tm-base-os-running-input-handler-path3 tm-base (os-running-input-handler-path3 (os)) = tm-base (os)

Event: Disable tm-base-os-running-input-handler-path3.

Theorem: tm-limit-os-running-input-handler-path3 tm-limit (os-running-input-handler-path3 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-input-handler-path3.

Theorem: tm-base-tm-limit-os-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ ((tm-base (os-running-input-handler-path3 (os))

= base (getnth (os-current-taskid (os-running-input-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-input-handler-path3 (os))

= limit (getnth (os-current-taskid (os-running-input-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-input-handler-path3.

Theorem: good-os-os-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-os (os-running-input-handler-path3 (os))

Event: Disable good-os-os-running-input-handler-path3.

Theorem: good-tm-os-running-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-tm (os-running-input-handler-path4 (os))

Event: Disable good-tm-os-running-input-handler-path4.

Theorem: tm-slimit-os-running-input-handler-path4 tm-slimit (os-running-input-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-input-handler-path4.

Theorem: os-code-os-running-input-handler-path4 good-tm (os) → (os-code (os-running-input-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-running-input-handler-path4.

Theorem: tm-interrupt-addresses-os-running-input-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-running-input-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-input-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-input-handler-path4 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-input-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-input-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-input-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-input-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-running-input-handler-path4 ¬ tm-in-supervisor-mode (os-running-input-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-input-handler-path4.

Theorem: os-task-table-os-running-input-handler-path4 good-tm (os) → (os-task-table (os-running-input-handler-path4 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-input-handler-path4.

Theorem: os-segment-table-os-running-input-handler-path4 good-tm (os) → (os-segment-table (os-running-input-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-input-handler-path4.

Theorem: os-readyq-os-running-input-handler-path4 good-tm (os) → (os-readyq (os-running-input-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-running-input-handler-path4.

Theorem: os-ibuffers-os-running-input-handler-path4 good-tm (os) → (os-ibuffers (os-running-input-handler-path4 (os))

= os-ibuffers-with-qreplaced-overflow-character (os))

Event: Disable os-ibuffers-os-running-input-handler-path4.

Theorem: finite-number-queue-listp-os-ibuffers-os-running-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-running-input-handler-path4 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-running-input-handler-path4.

Theorem: os-obuffers-os-running-input-handler-path4 good-tm (os) → (os-obuffers (os-running-input-handler-path4 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-input-handler-path4.

Theorem: os-mbuffers-os-running-input-handler-path4 good-tm (os) → (os-mbuffers (os-running-input-handler-path4 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-input-handler-path4.

Theorem: os-status-table-os-running-input-handler-path4 good-tm (os) → (os-status-table (os-running-input-handler-path4 (os))

= os-status-table (os))

Event: Disable os-status-table-os-running-input-handler-path4.

Theorem: not-tm-waiting-os-running-input-handler-path4 ¬ tm-waiting (os-running-input-handler-path4 (os))

Event: Disable not-tm-waiting-os-running-input-handler-path4.

Theorem: tm-base-os-running-input-handler-path4 tm-base (os-running-input-handler-path4 (os)) = tm-base (os)

Event: Disable tm-base-os-running-input-handler-path4.

Theorem: tm-limit-os-running-input-handler-path4 tm-limit (os-running-input-handler-path4 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-input-handler-path4.

Theorem: tm-base-tm-limit-os-running-input-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-running-input-handler-path4 (os))

= base (getnth (os-current-taskid (os-running-input-handler-path4 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-input-handler-path4 (os))

= limit (getnth (os-current-taskid (os-running-input-handler-path4 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-input-handler-path4.

Theorem: good-os-os-running-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ good-os (os-running-input-handler-path4 (os))

Event: Disable good-os-os-running-input-handler-path4.

Theorem: good-tm-os-running-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-tm (os-running-input-handler-path5 (os))

Event: Disable good-tm-os-running-input-handler-path5.

Theorem: tm-slimit-os-running-input-handler-path5 tm-slimit (os-running-input-handler-path5 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-input-handler-path5.

Theorem: os-code-os-running-input-handler-path5 good-tm (os) → (os-code (os-running-input-handler-path5 (os)) = os-code (os))

Event: Disable os-code-os-running-input-handler-path5.

Theorem: tm-interrupt-addresses-os-running-input-handler-path5 good-tm (os) → ((getnth ('3, tm-memory (os-running-input-handler-path5 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-input-handler-path5 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-input-handler-path5 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-input-handler-path5 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-input-handler-path5 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-input-handler-path5 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-input-handler-path5.

Theorem: not-tm-in-supervisor-mode-os-running-input-handler-path5 ¬ tm-in-supervisor-mode (os-running-input-handler-path5 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-input-handler-path5.

Theorem: os-task-table-os-running-input-handler-path5 good-tm (os) → (os-task-table (os-running-input-handler-path5 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-input-handler-path5.

Theorem: os-segment-table-os-running-input-handler-path5 good-tm (os) → (os-segment-table (os-running-input-handler-path5 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-input-handler-path5.

Theorem: os-readyq-os-running-input-handler-path5 good-tm (os) → (os-readyq (os-running-input-handler-path5 (os)) = os-readyq (os))

Event: Disable os-readyq-os-running-input-handler-path5.

Theorem: os-ibuffers-os-running-input-handler-path5 good-tm (os) → (os-ibuffers (os-running-input-handler-path5 (os))

= os-ibuffers-with-enqueued-overflow-character (os))

Event: Disable os-ibuffers-os-running-input-handler-path5.

Theorem: finite-number-queue-listp-os-ibuffers-os-running-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-running-input-handler-path5 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-running-input-handler-path5.

Theorem: os-obuffers-os-running-input-handler-path5 good-tm (os) → (os-obuffers (os-running-input-handler-path5 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-input-handler-path5.

Theorem: os-mbuffers-os-running-input-handler-path5 good-tm (os) → (os-mbuffers (os-running-input-handler-path5 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-input-handler-path5.

Theorem: os-status-table-os-running-input-handler-path5 good-tm (os) → (os-status-table (os-running-input-handler-path5 (os))

= os-status-table (os))

Event: Disable os-status-table-os-running-input-handler-path5.

Theorem: not-tm-waiting-os-running-input-handler-path5 ¬ tm-waiting (os-running-input-handler-path5 (os))

Event: Disable not-tm-waiting-os-running-input-handler-path5.

Theorem: tm-base-os-running-input-handler-path5 tm-base (os-running-input-handler-path5 (os)) = tm-base (os)

Event: Disable tm-base-os-running-input-handler-path5.

Theorem: tm-limit-os-running-input-handler-path5 tm-limit (os-running-input-handler-path5 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-input-handler-path5.

Theorem: tm-base-tm-limit-os-running-input-handler-path5 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-running-input-handler-path5 (os))

= base (getnth (os-current-taskid (os-running-input-handler-path5 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-input-handler-path5 (os))

= limit (getnth (os-current-taskid (os-running-input-handler-path5 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-input-handler-path5.

Theorem: good-os-os-running-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ good-os (os-running-input-handler-path5 (os))

Event: Disable good-os-os-running-input-handler-path5.

Theorem: good-tm-os-running-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-tm (os-running-input-handler-path6 (os))

Event: Disable good-tm-os-running-input-handler-path6.

Theorem: tm-slimit-os-running-input-handler-path6 tm-slimit (os-running-input-handler-path6 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-input-handler-path6.

Theorem: os-code-os-running-input-handler-path6 good-tm (os) → (os-code (os-running-input-handler-path6 (os)) = os-code (os))

Event: Disable os-code-os-running-input-handler-path6.

Theorem: tm-interrupt-addresses-os-running-input-handler-path6 good-tm (os) → ((getnth ('3, tm-memory (os-running-input-handler-path6 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-input-handler-path6 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-input-handler-path6 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-input-handler-path6 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-input-handler-path6 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-input-handler-path6 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-input-handler-path6.

Theorem: not-tm-in-supervisor-mode-os-running-input-handler-path6 ¬ tm-in-supervisor-mode (os-running-input-handler-path6 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-input-handler-path6.

Theorem: os-task-table-os-running-input-handler-path6 good-tm (os) → (os-task-table (os-running-input-handler-path6 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-input-handler-path6.

Theorem: os-segment-table-os-running-input-handler-path6 good-tm (os) → (os-segment-table (os-running-input-handler-path6 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-input-handler-path6.

Theorem: os-readyq-os-running-input-handler-path6 good-tm (os) → (os-readyq (os-running-input-handler-path6 (os)) = os-readyq (os))

Event: Disable os-readyq-os-running-input-handler-path6.

Theorem: os-ibuffers-os-running-input-handler-path6 good-tm (os) → (os-ibuffers (os-running-input-handler-path6 (os))

= os-ibuffers-with-enqueued-character (os))

Event: Disable os-ibuffers-os-running-input-handler-path6.

Theorem: finite-number-queue-listp-os-ibuffers-os-running-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)),

os)))))

→ finite-number-queue-listp (table ('8,

os-ibuffers (os-running-input-handler-path6 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-ibuffers-os-running-input-handler-path6.

Theorem: os-obuffers-os-running-input-handler-path6 good-tm (os) → (os-obuffers (os-running-input-handler-path6 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-input-handler-path6.

Theorem: os-mbuffers-os-running-input-handler-path6 good-tm (os) → (os-mbuffers (os-running-input-handler-path6 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-input-handler-path6.

Theorem: os-status-table-os-running-input-handler-path6 good-tm (os) → (os-status-table (os-running-input-handler-path6 (os))

= os-status-table (os))

Event: Disable os-status-table-os-running-input-handler-path6.

Theorem: not-tm-waiting-os-running-input-handler-path6 ¬ tm-waiting (os-running-input-handler-path6 (os))

Event: Disable not-tm-waiting-os-running-input-handler-path6.

Theorem: tm-base-os-running-input-handler-path6 tm-base (os-running-input-handler-path6 (os)) = tm-base (os)

Event: Disable tm-base-os-running-input-handler-path6.

Theorem: tm-limit-os-running-input-handler-path6 tm-limit (os-running-input-handler-path6 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-input-handler-path6.

Theorem: tm-base-tm-limit-os-running-input-handler-path6 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-running-input-handler-path6 (os))

= base (getnth (os-current-taskid (os-running-input-handler-path6 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-input-handler-path6 (os))

= limit (getnth (os-current-taskid (os-running-input-handler-path6 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-input-handler-path6.

Theorem: good-os-os-running-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ good-os (os-running-input-handler-path6 (os))

Event: Disable good-os-os-running-input-handler-path6.

Theorem: good-os-os-running-input-handler (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → good-os (os-running-input-handler (os))

Event: Disable good-os-os-running-input-handler.

Theorem: good-tm-os-intended-output-interrupt (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → good-tm (os-intended-output-interrupt (os))

Event: Disable good-tm-os-intended-output-interrupt.

Theorem: finite-number-queuep-array-enq-interrupting-output-port (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-output-interruptp (tm-oports (os))))

→ finite-number-queuep (array-enq (tm-interrupting-output-port (tm-oports (os)),

os-readyq (os)),

                       '16,
                       '16)

Event: Disable finite-number-queuep-array-enq-interrupting-output-port.

Theorem: good-tm-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-tm (os-waiting-output-handler-path1 (os))

Event: Disable good-tm-os-waiting-output-handler-path1.

Theorem: tm-slimit-os-waiting-output-handler-path1 tm-slimit (os-waiting-output-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-output-handler-path1.

Theorem: os-code-os-waiting-output-handler-path1 good-tm (os) → (os-code (os-waiting-output-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-waiting-output-handler-path1.

Theorem: tm-interrupt-addresses-os-waiting-output-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-output-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-output-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-output-handler-path1 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-output-handler-path1 (os)))

= getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-output-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-output-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-output-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-waiting-output-handler-path1 ¬ tm-in-supervisor-mode (os-waiting-output-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-output-handler-path1.

Theorem: os-task-table-os-waiting-output-handler-path1 good-tm (os) → (os-task-table (os-waiting-output-handler-path1 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-output-handler-path1.

Theorem: os-segment-table-os-waiting-output-handler-path1 good-tm (os) → (os-segment-table (os-waiting-output-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-output-handler-path1.

Theorem: os-readyq-os-waiting-output-handler-path1 good-tm (os) → (os-readyq (os-waiting-output-handler-path1 (os))

= array-enq (tm-interrupting-output-port (tm-oports (os)), os-readyq (os)))

Event: Disable os-readyq-os-waiting-output-handler-path1.

Theorem: os-ibuffers-os-waiting-output-handler-path1 good-tm (os) → (os-ibuffers (os-waiting-output-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-waiting-output-handler-path1.

Theorem: os-obuffers-os-waiting-output-handler-path1 good-tm (os) → (os-obuffers (os-waiting-output-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-output-handler-path1.

Theorem: os-mbuffers-os-waiting-output-handler-path1 good-tm (os) → (os-mbuffers (os-waiting-output-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-output-handler-path1.

Theorem: os-status-table-os-waiting-output-handler-path1 good-tm (os) → (os-status-table (os-waiting-output-handler-path1 (os))

= os-update-status (tm-interrupting-output-port (tm-oports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-waiting-output-handler-path1.

Theorem: good-status-list-os-status-table-os-waiting-output-handler-path1 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → good-status-list (table ('2,

os-status-table (os-waiting-output-handler-path1 (os))))

Event: Disable good-status-list-os-status-table-os-waiting-output-handler-path1.

Theorem: os-ready-set-os-waiting-output-handler-path1 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (os-ready-set (os-waiting-output-handler-path1 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-waiting-output-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ permutation (mapup-queue (array-enq (tm-interrupting-output-port (tm-oports (os)),

os-readyq (os))),

os-ready-set (os-waiting-output-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-waiting-output-handler-path1.

Theorem: not-tm-waiting-os-waiting-output-handler-path1 ¬ tm-waiting (os-waiting-output-handler-path1 (os))

Event: Disable not-tm-waiting-os-waiting-output-handler-path1.

Theorem: tm-base-os-waiting-output-handler-path1 tm-base (os-waiting-output-handler-path1 (os)) = base (getnth (tm-interrupting-output-port (tm-oports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-base-os-waiting-output-handler-path1.

Theorem: tm-limit-os-waiting-output-handler-path1 tm-limit (os-waiting-output-handler-path1 (os)) = limit (getnth (tm-interrupting-output-port (tm-oports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-limit-os-waiting-output-handler-path1.

Theorem: tm-base-tm-limit-os-waiting-output-handler-path1 (good-os (os) ∧ tm-waiting (os)) → ((tm-base (os-waiting-output-handler-path1 (os))

= base (getnth (os-current-taskid (os-waiting-output-handler-path1 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-waiting-output-handler-path1 (os))

= limit (getnth (os-current-taskid (os-waiting-output-handler-path1 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-waiting-output-handler-path1.

Theorem: good-os-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-os (os-waiting-output-handler-path1 (os))

Event: Disable good-os-os-waiting-output-handler-path1.

Theorem: good-tm-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-tm (os-waiting-output-handler-path2 (os))

Event: Disable good-tm-os-waiting-output-handler-path2.

Theorem: tm-slimit-os-waiting-output-handler-path2 tm-slimit (os-waiting-output-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-output-handler-path2.

Theorem: os-code-os-waiting-output-handler-path2 good-tm (os) → (os-code (os-waiting-output-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-waiting-output-handler-path2.

Theorem: tm-interrupt-addresses-os-waiting-output-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-output-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-output-handler-path2 (os)))

= getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-output-handler-path2 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-output-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-output-handler-path2 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-output-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-output-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-waiting-output-handler-path2 ¬ tm-in-supervisor-mode (os-waiting-output-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-output-handler-path2.

Theorem: os-task-table-os-waiting-output-handler-path2 good-tm (os) → (os-task-table (os-waiting-output-handler-path2 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-output-handler-path2.

Theorem: os-segment-table-os-waiting-output-handler-path2 good-tm (os) → (os-segment-table (os-waiting-output-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-output-handler-path2.

Theorem: os-readyq-os-waiting-output-handler-path2 good-tm (os) → (os-readyq (os-waiting-output-handler-path2 (os))

= array-enq (tm-interrupting-output-port (tm-oports (os)), os-readyq (os)))

Event: Disable os-readyq-os-waiting-output-handler-path2.

Theorem: os-ibuffers-os-waiting-output-handler-path2 good-tm (os) → (os-ibuffers (os-waiting-output-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-waiting-output-handler-path2.

Theorem: os-obuffers-os-waiting-output-handler-path2 good-tm (os) → (os-obuffers (os-waiting-output-handler-path2 (os))

= os-obuffers-with-dequeued-character (os))

Event: Disable os-obuffers-os-waiting-output-handler-path2.

Theorem: finite-number-queue-listp-os-obuffers-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-obuffers (os-waiting-output-handler-path2 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-obuffers-os-waiting-output-handler-path2.

Theorem: os-mbuffers-os-waiting-output-handler-path2 good-tm (os) → (os-mbuffers (os-waiting-output-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-output-handler-path2.

Theorem: os-status-table-os-waiting-output-handler-path2 good-tm (os) → (os-status-table (os-waiting-output-handler-path2 (os))

= os-update-status (tm-interrupting-output-port (tm-oports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-waiting-output-handler-path2.

Theorem: good-status-list-os-status-table-os-waiting-output-handler-path2 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → good-status-list (table ('2,

os-status-table (os-waiting-output-handler-path2 (os))))

Event: Disable good-status-list-os-status-table-os-waiting-output-handler-path2.

Theorem: os-ready-set-os-waiting-output-handler-path2 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (os-ready-set (os-waiting-output-handler-path2 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-waiting-output-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ permutation (mapup-queue (array-enq (tm-interrupting-output-port (tm-oports (os)),

os-readyq (os))),

os-ready-set (os-waiting-output-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-waiting-output-handler-path2.

Theorem: not-tm-waiting-os-waiting-output-handler-path2 ¬ tm-waiting (os-waiting-output-handler-path2 (os))

Event: Disable not-tm-waiting-os-waiting-output-handler-path2.

Theorem: tm-base-os-waiting-output-handler-path2 tm-base (os-waiting-output-handler-path2 (os)) = base (getnth (tm-interrupting-output-port (tm-oports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-base-os-waiting-output-handler-path2.

Theorem: tm-limit-os-waiting-output-handler-path2 tm-limit (os-waiting-output-handler-path2 (os)) = limit (getnth (tm-interrupting-output-port (tm-oports (os)),

table ('2, os-segment-table (os))))

Event: Disable tm-limit-os-waiting-output-handler-path2.

Theorem: tm-base-tm-limit-os-waiting-output-handler-path2 (good-os (os) ∧ tm-waiting (os)) → ((tm-base (os-waiting-output-handler-path2 (os))

= base (getnth (os-current-taskid (os-waiting-output-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-waiting-output-handler-path2 (os))

= limit (getnth (os-current-taskid (os-waiting-output-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-waiting-output-handler-path2.

Theorem: good-os-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-os (os-waiting-output-handler-path2 (os))

Event: Disable good-os-os-waiting-output-handler-path2.

Theorem: good-tm-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-tm (os-waiting-output-handler-path3 (os))

Event: Disable good-tm-os-waiting-output-handler-path3.

Theorem: tm-slimit-os-waiting-output-handler-path3 tm-slimit (os-waiting-output-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-output-handler-path3.

Theorem: os-code-os-waiting-output-handler-path3 good-tm (os) → (os-code (os-waiting-output-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-waiting-output-handler-path3.

Theorem: tm-interrupt-addresses-os-waiting-output-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-output-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-output-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-output-handler-path3 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-output-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-output-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-output-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-output-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-waiting-output-handler-path3 ¬ tm-in-supervisor-mode (os-waiting-output-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-output-handler-path3.

Theorem: os-task-table-os-waiting-output-handler-path3 good-tm (os)

→ (os-task-table (os-waiting-output-handler-path3 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-output-handler-path3.

Theorem: os-segment-table-os-waiting-output-handler-path3 good-tm (os) → (os-segment-table (os-waiting-output-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-output-handler-path3.

Theorem: os-readyq-os-waiting-output-handler-path3 good-tm (os) → (os-readyq (os-waiting-output-handler-path3 (os)) = os-readyq (os))

Event: Disable os-readyq-os-waiting-output-handler-path3.

Theorem: os-ibuffers-os-waiting-output-handler-path3 good-tm (os) → (os-ibuffers (os-waiting-output-handler-path3 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-waiting-output-handler-path3.

Theorem: os-obuffers-os-waiting-output-handler-path3 good-tm (os) → (os-obuffers (os-waiting-output-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-waiting-output-handler-path3.

Theorem: os-mbuffers-os-waiting-output-handler-path3 good-tm (os) → (os-mbuffers (os-waiting-output-handler-path3 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-output-handler-path3.

Theorem: os-status-table-os-waiting-output-handler-path3 good-tm (os) → (os-status-table (os-waiting-output-handler-path3 (os))

= os-status-table (os))

Event: Disable os-status-table-os-waiting-output-handler-path3.

Theorem: tm-waiting-os-waiting-output-handler-path3 tm-waiting (os-waiting-output-handler-path3 (os))

Event: Disable tm-waiting-os-waiting-output-handler-path3.

Theorem: good-os-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-os (os-waiting-output-handler-path3 (os))

Event: Disable good-os-os-waiting-output-handler-path3.

Theorem: good-tm-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-tm (os-waiting-output-handler-path4 (os))

Event: Disable good-tm-os-waiting-output-handler-path4.

Theorem: tm-slimit-os-waiting-output-handler-path4 tm-slimit (os-waiting-output-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-waiting-output-handler-path4.

Theorem: os-code-os-waiting-output-handler-path4 good-tm (os) → (os-code (os-waiting-output-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-waiting-output-handler-path4.

Theorem: tm-interrupt-addresses-os-waiting-output-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-waiting-output-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-waiting-output-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-waiting-output-handler-path4 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-waiting-output-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-waiting-output-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-waiting-output-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-waiting-output-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-waiting-output-handler-path4 ¬ tm-in-supervisor-mode (os-waiting-output-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-waiting-output-handler-path4.

Theorem: os-task-table-os-waiting-output-handler-path4 good-tm (os) → (os-task-table (os-waiting-output-handler-path4 (os))

= os-task-table (os))

Event: Disable os-task-table-os-waiting-output-handler-path4.

Theorem: os-segment-table-os-waiting-output-handler-path4 good-tm (os) → (os-segment-table (os-waiting-output-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-waiting-output-handler-path4.

Theorem: os-readyq-os-waiting-output-handler-path4 good-tm (os) → (os-readyq (os-waiting-output-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-waiting-output-handler-path4.

Theorem: os-ibuffers-os-waiting-output-handler-path4 good-tm (os) → (os-ibuffers (os-waiting-output-handler-path4 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-waiting-output-handler-path4.

Theorem: os-obuffers-os-waiting-output-handler-path4 good-tm (os) → (os-obuffers (os-waiting-output-handler-path4 (os))

= os-obuffers-with-dequeued-character (os))

Event: Disable os-obuffers-os-waiting-output-handler-path4.

Theorem: finite-number-queue-listp-os-obuffers-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-obuffers (os-waiting-output-handler-path4 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-obuffers-os-waiting-output-handler-path4.

Theorem: os-mbuffers-os-waiting-output-handler-path4 good-tm (os) → (os-mbuffers (os-waiting-output-handler-path4 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-waiting-output-handler-path4.

Theorem: os-status-table-os-waiting-output-handler-path4 good-tm (os) → (os-status-table (os-waiting-output-handler-path4 (os))

= os-status-table (os))

Event: Disable os-status-table-os-waiting-output-handler-path4.

Theorem: tm-waiting-os-waiting-output-handler-path4 tm-waiting (os-waiting-output-handler-path4 (os))

Event: Disable tm-waiting-os-waiting-output-handler-path4.

Theorem: good-os-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-os (os-waiting-output-handler-path4 (os))

Event: Disable good-os-os-waiting-output-handler-path4.

Theorem: good-os-os-waiting-output-handler (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → good-os (os-waiting-output-handler (os))

Event: Disable good-os-os-waiting-output-handler.

Theorem: finite-number-queuep-array-enq-interrupting-output-port2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ finite-number-queuep (array-enq (tm-interrupting-output-port (tm-oports (os)),

os-readyq (os)),

                       '16,
                       '16)

Event: Disable finite-number-queuep-array-enq-interrupting-output-port2.

Theorem: good-tm-os-running-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os))

∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-tm (os-running-output-handler-path1 (os))

Event: Disable good-tm-os-running-output-handler-path1.

Theorem: tm-slimit-os-running-output-handler-path1 tm-slimit (os-running-output-handler-path1 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-output-handler-path1.

Theorem: os-code-os-running-output-handler-path1 good-tm (os) → (os-code (os-running-output-handler-path1 (os)) = os-code (os))

Event: Disable os-code-os-running-output-handler-path1.

Theorem: tm-interrupt-addresses-os-running-output-handler-path1 good-tm (os) → ((getnth ('3, tm-memory (os-running-output-handler-path1 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-output-handler-path1 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-output-handler-path1 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-output-handler-path1 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-output-handler-path1 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-output-handler-path1 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-output-handler-path1.

Theorem: not-tm-in-supervisor-mode-os-running-output-handler-path1 ¬ tm-in-supervisor-mode (os-running-output-handler-path1 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-output-handler-path1.

Theorem: os-task-table-os-running-output-handler-path1 good-tm (os) → (os-task-table (os-running-output-handler-path1 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-output-handler-path1.

Theorem: os-segment-table-os-running-output-handler-path1 good-tm (os) → (os-segment-table (os-running-output-handler-path1 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-output-handler-path1.

Theorem: os-readyq-os-running-output-handler-path1 good-tm (os) → (os-readyq (os-running-output-handler-path1 (os))

= array-enq (tm-interrupting-output-port (tm-oports (os)), os-readyq (os)))

Event: Disable os-readyq-os-running-output-handler-path1.

Theorem: os-ibuffers-os-running-output-handler-path1 good-tm (os) → (os-ibuffers (os-running-output-handler-path1 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-running-output-handler-path1.

Theorem: os-obuffers-os-running-output-handler-path1 good-tm (os) → (os-obuffers (os-running-output-handler-path1 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-output-handler-path1.

Theorem: os-mbuffers-os-running-output-handler-path1 good-tm (os) → (os-mbuffers (os-running-output-handler-path1 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-output-handler-path1.

Theorem: os-status-table-os-running-output-handler-path1 good-tm (os) → (os-status-table (os-running-output-handler-path1 (os))

= os-update-status (tm-interrupting-output-port (tm-oports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-running-output-handler-path1.

Theorem: good-status-list-os-status-table-os-running-output-handler-path1 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → good-status-list (table ('2,

os-status-table (os-running-output-handler-path1 (os))))

Event: Disable good-status-list-os-status-table-os-running-output-handler-path1.

Theorem: os-ready-set-os-running-output-handler-path1 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (os-ready-set (os-running-output-handler-path1 (os))

= index-ready-set ('0,

putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-running-output-handler-path1.

Theorem: permutation-os-readyq-os-ready-set-for-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ permutation (mapup-queue (array-enq (tm-interrupting-output-port (tm-oports (os)),

os-readyq (os))),

os-ready-set (os-running-output-handler-path1 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-running-output-handler-path1.

Theorem: not-tm-waiting-os-running-output-handler-path1 ¬ tm-waiting (os-running-output-handler-path1 (os))

Event: Disable not-tm-waiting-os-running-output-handler-path1.

Theorem: tm-base-os-running-output-handler-path1 tm-base (os-running-output-handler-path1 (os)) = tm-base (os)

Event: Disable tm-base-os-running-output-handler-path1.

Theorem: tm-limit-os-running-output-handler-path1 tm-limit (os-running-output-handler-path1 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-output-handler-path1.

Theorem: tm-base-tm-limit-os-running-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ ((tm-base (os-running-output-handler-path1 (os))

= base (getnth (os-current-taskid (os-running-output-handler-path1 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-output-handler-path1 (os))

= limit (getnth (os-current-taskid (os-running-output-handler-path1 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-output-handler-path1.

Theorem: good-os-os-running-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-os (os-running-output-handler-path1 (os))

Event: Disable good-os-os-running-output-handler-path1.

Theorem: good-tm-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-tm (os-running-output-handler-path2 (os))

Event: Disable good-tm-os-running-output-handler-path2.

Theorem: tm-slimit-os-running-output-handler-path2 tm-slimit (os-running-output-handler-path2 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-output-handler-path2.

Theorem: os-code-os-running-output-handler-path2 good-tm (os) → (os-code (os-running-output-handler-path2 (os)) = os-code (os))

Event: Disable os-code-os-running-output-handler-path2.

Theorem: tm-interrupt-addresses-os-running-output-handler-path2 good-tm (os) → ((getnth ('3, tm-memory (os-running-output-handler-path2 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-output-handler-path2 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-output-handler-path2 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-output-handler-path2 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-output-handler-path2 (os))) = getnth ('7, tm-memory (os)))

∧ (getnth ('11,

tm-memory (os-running-output-handler-path2 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-output-handler-path2.

Theorem: not-tm-in-supervisor-mode-os-running-output-handler-path2 ¬ tm-in-supervisor-mode (os-running-output-handler-path2 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-output-handler-path2.

Theorem: os-task-table-os-running-output-handler-path2 good-tm (os) → (os-task-table (os-running-output-handler-path2 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-output-handler-path2.

Theorem: os-segment-table-os-running-output-handler-path2 good-tm (os) → (os-segment-table (os-running-output-handler-path2 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-output-handler-path2.

Theorem: os-readyq-os-running-output-handler-path2 good-tm (os) → (os-readyq (os-running-output-handler-path2 (os))

= array-enq (tm-interrupting-output-port (tm-oports (os)), os-readyq (os)))

Event: Disable os-readyq-os-running-output-handler-path2.

Theorem: os-ibuffers-os-running-output-handler-path2 good-tm (os) → (os-ibuffers (os-running-output-handler-path2 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-running-output-handler-path2.

Theorem: os-obuffers-os-running-output-handler-path2 good-tm (os) → (os-obuffers (os-running-output-handler-path2 (os))

= os-obuffers-with-dequeued-character (os))

Event: Disable os-obuffers-os-running-output-handler-path2.

Theorem: finite-number-queue-listp-os-obuffers-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-obuffers (os-running-output-handler-path2 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-obuffers-os-running-output-handler-path2.

Theorem: os-mbuffers-os-running-output-handler-path2 good-tm (os) → (os-mbuffers (os-running-output-handler-path2 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-output-handler-path2.

Theorem: os-status-table-os-running-output-handler-path2 good-tm (os) → (os-status-table (os-running-output-handler-path2 (os))

= os-update-status (tm-interrupting-output-port (tm-oports (os)),

                        '0,
                        '0,

os))

Event: Disable os-status-table-os-running-output-handler-path2.

Theorem: good-status-list-os-status-table-os-running-output-handler-path2 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → good-status-list (table ('2,

os-status-table (os-running-output-handler-path2 (os))))

Event: Disable good-status-list-os-status-table-os-running-output-handler-path2.

Theorem: os-ready-set-os-running-output-handler-path2 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (os-ready-set (os-running-output-handler-path2 (os))

= index-ready-set ('0, putnth ('(0 0),

tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os)))))

Event: Disable os-ready-set-os-running-output-handler-path2.

Theorem: permutation-os-readyq-os-ready-set-for-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ permutation (mapup-queue (array-enq (tm-interrupting-output-port (tm-oports (os)),

os-readyq (os))),

os-ready-set (os-running-output-handler-path2 (os)))

Event: Disable permutation-os-readyq-os-ready-set-for-os-running-output-handler-path2.

Theorem: not-tm-waiting-os-running-output-handler-path2 ¬ tm-waiting (os-running-output-handler-path2 (os))

Event: Disable not-tm-waiting-os-running-output-handler-path2.

Theorem: tm-base-os-running-output-handler-path2 tm-base (os-running-output-handler-path2 (os)) = tm-base (os)

Event: Disable tm-base-os-running-output-handler-path2.

Theorem: tm-limit-os-running-output-handler-path2 tm-limit (os-running-output-handler-path2 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-output-handler-path2.

Theorem: tm-base-tm-limit-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ (getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os)) = '4))))

→ ((tm-base (os-running-output-handler-path2 (os))

= base (getnth (os-current-taskid (os-running-output-handler-path2 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-output-handler-path2 (os))

= limit (getnth (os-current-taskid (os-running-output-handler-path2 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-output-handler-path2.

Theorem: good-os-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-os (os-running-output-handler-path2 (os))

Event: Disable good-os-os-running-output-handler-path2.

Theorem: good-tm-os-running-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-tm (os-running-output-handler-path3 (os))

Event: Disable good-tm-os-running-output-handler-path3.

Theorem: tm-slimit-os-running-output-handler-path3 tm-slimit (os-running-output-handler-path3 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-output-handler-path3.

Theorem: os-code-os-running-output-handler-path3 good-tm (os) → (os-code (os-running-output-handler-path3 (os)) = os-code (os))

Event: Disable os-code-os-running-output-handler-path3.

Theorem: tm-interrupt-addresses-os-running-output-handler-path3 good-tm (os) → ((getnth ('3, tm-memory (os-running-output-handler-path3 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-output-handler-path3 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-output-handler-path3 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-output-handler-path3 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-output-handler-path3 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-output-handler-path3 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-output-handler-path3.

Theorem: not-tm-in-supervisor-mode-os-running-output-handler-path3 ¬ tm-in-supervisor-mode (os-running-output-handler-path3 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-output-handler-path3.

Theorem: os-task-table-os-running-output-handler-path3 good-tm (os) → (os-task-table (os-running-output-handler-path3 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-output-handler-path3.

Theorem: os-segment-table-os-running-output-handler-path3 good-tm (os) → (os-segment-table (os-running-output-handler-path3 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-output-handler-path3.

Theorem: os-readyq-os-running-output-handler-path3 good-tm (os) → (os-readyq (os-running-output-handler-path3 (os)) = os-readyq (os))

Event: Disable os-readyq-os-running-output-handler-path3.

Theorem: os-ibuffers-os-running-output-handler-path3 good-tm (os) → (os-ibuffers (os-running-output-handler-path3 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-running-output-handler-path3.

Theorem: os-obuffers-os-running-output-handler-path3 good-tm (os) → (os-obuffers (os-running-output-handler-path3 (os)) = os-obuffers (os))

Event: Disable os-obuffers-os-running-output-handler-path3.

Theorem: os-mbuffers-os-running-output-handler-path3 good-tm (os) → (os-mbuffers (os-running-output-handler-path3 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-output-handler-path3.

Theorem: os-status-table-os-running-output-handler-path3 good-tm (os) → (os-status-table (os-running-output-handler-path3 (os))

= os-status-table (os))

Event: Disable os-status-table-os-running-output-handler-path3.

Theorem: not-tm-waiting-os-running-output-handler-path3 ¬ tm-waiting (os-running-output-handler-path3 (os))

Event: Disable not-tm-waiting-os-running-output-handler-path3.

Theorem: tm-base-os-running-output-handler-path3 tm-base (os-running-output-handler-path3 (os)) = tm-base (os)

Event: Disable tm-base-os-running-output-handler-path3.

Theorem: tm-limit-os-running-output-handler-path3 tm-limit (os-running-output-handler-path3 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-output-handler-path3.

Theorem: tm-base-tm-limit-os-running-output-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-running-output-handler-path3 (os))

= base (getnth (os-current-taskid (os-running-output-handler-path3 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-output-handler-path3 (os))

= limit (getnth (os-current-taskid (os-running-output-handler-path3 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-output-handler-path3.

Theorem: good-os-os-running-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ good-os (os-running-output-handler-path3 (os))

Event: Disable good-os-os-running-output-handler-path3.

Theorem: good-tm-os-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-tm (os-running-output-handler-path4 (os))

Event: Disable good-tm-os-running-output-handler-path4.

Theorem: tm-slimit-os-running-output-handler-path4 tm-slimit (os-running-output-handler-path4 (os)) = tm-slimit (os)

Event: Disable tm-slimit-os-running-output-handler-path4.

Theorem: os-code-os-running-output-handler-path4 good-tm (os) → (os-code (os-running-output-handler-path4 (os)) = os-code (os))

Event: Disable os-code-os-running-output-handler-path4.

Theorem: tm-interrupt-addresses-os-running-output-handler-path4 good-tm (os) → ((getnth ('3, tm-memory (os-running-output-handler-path4 (os)))

= getnth ('3, tm-memory (os)))

∧ ((getnth ('4, tm-memory (os-running-output-handler-path4 (os))) = getnth ('4, tm-memory (os))) ∧ ((getnth ('5,

tm-memory (os-running-output-handler-path4 (os))) = getnth ('5, tm-memory (os))) ∧ ((getnth ('6,

tm-memory (os-running-output-handler-path4 (os))) = getnth ('6, tm-memory (os))) ∧ ((getnth ('7,

tm-memory (os-running-output-handler-path4 (os))) = getnth ('7, tm-memory (os))) ∧ (getnth ('11,

tm-memory (os-running-output-handler-path4 (os))) = getnth ('11,

tm-memory (os))))))))

Event: Disable tm-interrupt-addresses-os-running-output-handler-path4.

Theorem: not-tm-in-supervisor-mode-os-running-output-handler-path4 ¬ tm-in-supervisor-mode (os-running-output-handler-path4 (os))

Event: Disable not-tm-in-supervisor-mode-os-running-output-handler-path4.

Theorem: os-task-table-os-running-output-handler-path4 good-tm (os) → (os-task-table (os-running-output-handler-path4 (os))

= os-new-task-table (os))

Event: Disable os-task-table-os-running-output-handler-path4.

Theorem: os-segment-table-os-running-output-handler-path4 good-tm (os) → (os-segment-table (os-running-output-handler-path4 (os))

= os-segment-table (os))

Event: Disable os-segment-table-os-running-output-handler-path4.

Theorem: os-readyq-os-running-output-handler-path4 good-tm (os) → (os-readyq (os-running-output-handler-path4 (os)) = os-readyq (os))

Event: Disable os-readyq-os-running-output-handler-path4.

Theorem: os-ibuffers-os-running-output-handler-path4 good-tm (os) → (os-ibuffers (os-running-output-handler-path4 (os)) = os-ibuffers (os))

Event: Disable os-ibuffers-os-running-output-handler-path4.

Theorem: os-obuffers-os-running-output-handler-path4 good-tm (os) → (os-obuffers (os-running-output-handler-path4 (os))

= os-obuffers-with-dequeued-character (os))

Event: Disable os-obuffers-os-running-output-handler-path4.

Theorem: finite-number-queue-listp-os-obuffers-os-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ finite-number-queue-listp (table ('8,

os-obuffers (os-running-output-handler-path4 (os))),

                           '4,
                           '65536)

Event: Disable finite-number-queue-listp-os-obuffers-os-running-output-handler-path4.

Theorem: os-mbuffers-os-running-output-handler-path4 good-tm (os) → (os-mbuffers (os-running-output-handler-path4 (os)) = os-mbuffers (os))

Event: Disable os-mbuffers-os-running-output-handler-path4.

Theorem: os-status-table-os-running-output-handler-path4 good-tm (os) → (os-status-table (os-running-output-handler-path4 (os))

= os-status-table (os))

Event: Disable os-status-table-os-running-output-handler-path4.

Theorem: not-tm-waiting-os-running-output-handler-path4 ¬ tm-waiting (os-running-output-handler-path4 (os))

Event: Disable not-tm-waiting-os-running-output-handler-path4.

Theorem: tm-base-os-running-output-handler-path4 tm-base (os-running-output-handler-path4 (os)) = tm-base (os)

Event: Disable tm-base-os-running-output-handler-path4.

Theorem: tm-limit-os-running-output-handler-path4 tm-limit (os-running-output-handler-path4 (os)) = tm-limit (os)

Event: Disable tm-limit-os-running-output-handler-path4.

Theorem: tm-base-tm-limit-os-running-output-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-base (os-running-output-handler-path4 (os))

= base (getnth (os-current-taskid (os-running-output-handler-path4 (os)), table ('2, os-segment-table (os)))))

∧ (tm-limit (os-running-output-handler-path4 (os))

= limit (getnth (os-current-taskid (os-running-output-handler-path4 (os)), table ('2, os-segment-table (os))))))

Event: Disable tm-base-tm-limit-os-running-output-handler-path4.

Theorem: good-os-os-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os))

∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

           ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ good-os (os-running-output-handler-path4 (os))

Event: Disable good-os-os-running-output-handler-path4.

Theorem: good-os-os-running-output-handler (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (¬ tm-waiting (os)))) → good-os (os-running-output-handler (os))

Event: Disable good-os-os-running-output-handler.

Definition: os-svc-handler (os) = if (tm-svcid (os) mod '4) = '0 then os-svc-send-handler (os)

elseif (tm-svcid (os) mod '4) = '1 then os-svc-receive-handler (os) elseif (tm-svcid (os) mod '4) = '2 then os-svc-tyo-handler (os) else os-svc-tyi-handler (os) endif

Definition: os-time-for-svc-handler (os) = if (tm-svcid (os) mod '4) = '0

then os-time-for-svc-send-handler (os) elseif (tm-svcid (os) mod '4) = '1 then os-time-for-svc-receive-handler (os) elseif (tm-svcid (os) mod '4) = '2 then os-time-for-svc-tyo-handler (os) else os-time-for-svc-tyi-handler (os) endif

Definition: os-intended-svc-interrupt (os) = if (tm-svcid (os) mod '4) = '0

then os-intended-svc-send-interrupt (os) elseif (tm-svcid (os) mod '4) = '1 then os-intended-svc-receive-interrupt (os) elseif (tm-svcid (os) mod '4) = '2 then os-intended-svc-tyo-interrupt (os) else os-intended-svc-tyi-interrupt (os) endif Theorem: equivalence-of-svc-interrupt-expressions (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-execute-svc-interrupt (os) = os-intended-svc-interrupt (os))

Event: Disable equivalence-of-svc-interrupt-expressions.

Theorem: lessp-4-crock ((a ∈ N) ∧ ((a < '4) ∧ ((a ≠ '0) ∧ ((a ≠ '1) ∧ (a ≠ '2))))) → (a = '3)

Theorem: remainder-4-equals-3 (((n mod '4) ≠ '0) ∧ (((n mod '4) ≠ '1) ∧ ((n mod '4) ≠ '2))) → ((n mod '4) = '3)

Event: Disable remainder-4-equals-3.

Theorem: trace-svc-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (tm-processor (os-intended-svc-interrupt (os),

os-time-for-svc-handler (os))

= os-svc-handler (os))

Event: Disable trace-svc-interrupt-handler.

Theorem: good-os-os-svc-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → good-os (os-svc-handler (os))

Event: Disable good-os-os-svc-handler.

Definition: os-input-interrupt-handler (os) = if tm-waiting (os) then os-waiting-input-handler (os)

else os-running-input-handler (os) endif

Definition: os-time-for-input-interrupt-handler (os) = if tm-waiting (os) then os-time-for-waiting-input-handler (os)

else os-time-for-running-input-handler (os) endif

Theorem: trace-input-interrupt-handler (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os)))

→ (tm-processor (os-intended-input-interrupt (os),

os-time-for-input-interrupt-handler (os))

= os-input-interrupt-handler (os))

Event: Disable trace-input-interrupt-handler.

Theorem: good-os-os-input-interrupt-handler (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → good-os (os-input-interrupt-handler (os))

Event: Disable good-os-os-input-interrupt-handler.

Definition: os-output-interrupt-handler (os) = if tm-waiting (os) then os-waiting-output-handler (os)

else os-running-output-handler (os) endif

Definition: os-time-for-output-interrupt-handler (os) = if tm-waiting (os) then os-time-for-waiting-output-handler (os)

else os-time-for-running-output-handler (os) endif

Theorem: trace-output-interrupt-handler (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (tm-processor (os-intended-output-interrupt (os),

os-time-for-output-interrupt-handler (os))

= os-output-interrupt-handler (os))

Event: Disable trace-output-interrupt-handler.

Theorem: good-os-os-output-interrupt-handler (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → good-os (os-output-interrupt-handler (os))

Event: Disable good-os-os-output-interrupt-handler.

Definition: os-step (os) = if tm-input-interruptp (os) then os-input-interrupt-handler (os)

elseif tm-output-interruptp (os) then os-output-interrupt-handler (os) elseif tm-waiting (os) then os elseif tm-errorp (os) then os-error-handler (os) elseif tm-clock-interruptp (os) then os-clock-interrupt-handler (os) elseif tm-svc-interruptp (os) then os-svc-handler (os) else tm-fetch-execute (os) endif Definition: os-processor (os, oracle) = if listp (oracle)

then os-processor (os-step (tm-post-interrupt (car (oracle), os)),

cdr (oracle))

else os endif

Theorem: good-os-os-step good-os (os) → good-os (os-step (os))

Event: Disable good-os-os-step.

Theorem: good-os-os-processor good-os (os) → good-os (os-processor (os, oracle))

Event: Disable good-os-os-processor.

Definition: timed-tm-step (tm) = if tm-input-interruptp (tm)

then tm-processor (tm-execute-input-interrupt (tm),

os-time-for-input-interrupt-handler (tm))

elseif tm-output-interruptp (tm) then tm-processor (tm-execute-output-interrupt (tm),

os-time-for-output-interrupt-handler (tm))

elseif tm-waiting (tm) then tm elseif tm-errorp (tm) then tm-processor (tm-execute-error-interrupt (tm),

os-time-for-error-handler (tm))

elseif tm-clock-interruptp (tm) then tm-processor (tm-execute-clock-interrupt (tm),

os-time-for-clock-interrupt-handler (tm))

elseif tm-svc-interruptp (tm) then tm-processor (tm-execute-svc-interrupt (tm),

os-time-for-svc-handler (tm))

else tm-fetch-execute (tm) endif

Definition: timed-tm-processor (tm, oracle) = if listp (oracle)

then timed-tm-processor (timed-tm-step (tm-post-interrupt (car (oracle),

tm)),

cdr (oracle))

else tm endif Definition: os-oracle-step (event, os) = if tm-input-interruptp (os)

then cons (event, os-time-for-input-interrupt-handler (os))

elseif tm-output-interruptp (os)

then cons (event, os-time-for-output-interrupt-handler (os))

elseif tm-waiting (os) then cons (event, 'nil)

elseif tm-errorp (os) then cons (event, os-time-for-error-handler (os)) elseif tm-clock-interruptp (os) then cons (event, os-time-for-clock-interrupt-handler (os)) elseif tm-svc-interruptp (os) then cons (event, os-time-for-svc-handler (os)) else cons (event, 'nil) endif

Definition: os-oracle (os, oracle) = if listp (oracle)

then append (os-oracle-step (car (oracle),

tm-post-interrupt (car (oracle), os)), os-oracle (timed-tm-step (tm-post-interrupt (car (oracle), os)),

cdr (oracle)))

else oracle endif

Theorem: tm-processor-oracle-distributes tm-processor (tm, append (a, b)) = tm-processor (tm-processor (tm, a), b)

Event: Disable tm-processor-oracle-distributes.

Theorem: tm-processor-implements-timed-tm-step tm-processor (tm, os-oracle-step (x, tm-post-interrupt (x, tm))) = timed-tm-step (tm-post-interrupt (x, tm))

Event: Disable tm-processor-implements-timed-tm-step.

Theorem: tm-implements-timed-tm tm-processor (tm, os-oracle (tm, oracle)) = timed-tm-processor (tm, oracle)

Event: Disable tm-implements-timed-tm.

Definition: btimed-tm-processor (tm, oracle) = if listp (oracle)

then timed-tm-step (tm-post-interrupt (car (oracle), btimed-tm-processor (tm,

cdr (oracle))))

else tm endif

Theorem: timed-tm-implements-btimed-tm timed-tm-processor (tm, oracle) = btimed-tm-processor (tm, reverse (oracle))

Event: Disable timed-tm-implements-btimed-tm.

Definition: bos-processor (os, oracle) = if listp (oracle)

then os-step (tm-post-interrupt (car (oracle),

bos-processor (os, cdr (oracle))))

else os endif

Theorem: bos-implements-os bos-processor (os, reverse (oracle)) = os-processor (os, oracle)

Event: Disable bos-implements-os.

Theorem: timed-tm-step-implements-os-step good-os (os) → (timed-tm-step (os) = os-step (os))

Event: Disable timed-tm-step-implements-os-step.

Theorem: good-os-bos-processor good-os (os) → good-os (bos-processor (os, oracle))

Event: Disable good-os-bos-processor.

Theorem: good-os-timed-tm-step good-os (os) → good-os (timed-tm-step (os))

Event: Disable good-os-timed-tm-step.

Theorem: good-os-btimed-tm-processor good-os (os) → good-os (btimed-tm-processor (os, oracle))

Event: Disable good-os-btimed-tm-processor.

Theorem: btimed-tm-implements-bos good-os (os) → (btimed-tm-processor (os, oracle) = bos-processor (os, oracle))

Event: Disable btimed-tm-implements-bos.

Theorem: tm-implements-os good-os (os) → (tm-processor (os, os-oracle (os, oracle)) = os-processor (os, oracle))

Event: Disable tm-implements-os.

Theorem: mapup-base-os-clock-interrupt-handler good-os (os) → (mapup-base (taskid, os-clock-interrupt-handler (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-clock-interrupt-handler.

Theorem: mapup-limit-os-clock-interrupt-handler good-os (os) → (mapup-limit (taskid, os-clock-interrupt-handler (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-clock-interrupt-handler.

Theorem: getseg-tm-memory-os-clock-interrupt-handler (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-clock-interrupt-handler (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-clock-interrupt-handler.

(PROVE-LEMMA
 TM-CPU-OS-CLOCK-INTERRUPT-HANDLER-CROCK
 (REWRITE)
 (IMPLIES
  (AND (GOOD-OS OS)
       (NOT (TM-WAITING OS)))
  (EQUAL

(TM-CPU (OS-CLOCK-INTERRUPT-HANDLER OS))
(CONS
(GETNTH '0
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
 OS))
(CONS
(GETNTH '1
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
  OS))
(CONS
(GETNTH '2
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
   OS))
(CONS
(GETNTH '3
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
    OS))
(CONS
(GETNTH '4
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
     OS))
(CONS
(GETNTH '5
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
      OS))
(CONS
(GETNTH '6
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
       OS))
(CONS
(GETNTH '7
(OS-NEW-REGS (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
        OS))
(CONS
(TM-PACK-PSW
(OS-NEW-CC (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (OS-CLOCK-NEW-READYQ OS))
              OS))
'NIL)))))))))))

((ENABLE OS-CLOCK-INTERRUPT-HANDLER TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4
         TM-R5 TM-R6 TM-R7)
 (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
 (DISABLE-THEORY T)))

Event: Disable tm-cpu-os-clock-interrupt-handler-crock.

Theorem: tm-cpu-os-clock-interrupt-handler-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (os-clock-new-readyq (os)) = array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-clock-interrupt-handler (os))

= getnth (os-current-taskid (os-clock-interrupt-handler (os)),

table ('9, os-task-table (os-clock-interrupt-handler (os)))))

Theorem: tm-cpu-os-clock-interrupt-handler-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (os-clock-new-readyq (os)) ≠ array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-clock-interrupt-handler (os))

= getnth (os-current-taskid (os-clock-interrupt-handler (os)),

table ('9, os-task-table (os-clock-interrupt-handler (os)))))

Theorem: tm-cpu-os-clock-interrupt-handler (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-clock-interrupt-handler (os))

= getnth (os-current-taskid (os-clock-interrupt-handler (os)),

table ('9, os-task-table (os-clock-interrupt-handler (os)))))

Event: Disable tm-cpu-os-clock-interrupt-handler.

Theorem: mapup-cpu-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-clock-interrupt-handler (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-clock-interrupt-handler.

Theorem: mapup-regs-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-clock-interrupt-handler (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-clock-interrupt-handler.

Theorem: mapup-cc-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-clock-interrupt-handler (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-clock-interrupt-handler.

Theorem: mapup-error-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-clock-interrupt-handler (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-clock-interrupt-handler.

Theorem: mapup-svcflag-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-clock-interrupt-handler (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-clock-interrupt-handler.

Theorem: mapup-svcid-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-clock-interrupt-handler (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-clock-interrupt-handler.

Theorem: mapup-task-os-clock-interrupt-handler (good-os (os)

∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-clock-interrupt-handler (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-clock-interrupt-handler.

Theorem: mapup-tasks-os-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-clock-interrupt-handler (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-clock-interrupt-handler.

Theorem: mapup-os-tasks-os-clock-interrupt-handler (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-clock-interrupt-handler (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-clock-interrupt-handler.

Theorem: mapup-os-ibuffers-os-clock-interrupt-handler good-os (os) → (mapup-os-ibuffers (os-clock-interrupt-handler (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-clock-interrupt-handler.

Theorem: mapup-os-obuffers-os-clock-interrupt-handler good-os (os) → (mapup-os-obuffers (os-clock-interrupt-handler (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-clock-interrupt-handler.

Theorem: mapup-os-mbuffers-os-clock-interrupt-handler good-os (os) → (mapup-os-mbuffers (os-clock-interrupt-handler (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-clock-interrupt-handler.

Theorem: mapup-queue-os-readyq-os-clock-interrupt-handler (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-clock-interrupt-handler (os)))

= enq (qfirst (mapup-queue (os-readyq (os))), deq (mapup-queue (os-readyq (os)))))

Event: Disable mapup-queue-os-readyq-os-clock-interrupt-handler.

Theorem: mapup-os-status-table-os-clock-interrupt-handler good-os (os) → (table ('2, os-status-table (os-clock-interrupt-handler (os)))

= table ('2, os-status-table (os)))

Event: Disable mapup-os-status-table-os-clock-interrupt-handler.

Theorem: tm-rwstate-os-clock-interrupt-handler tm-rwstate (os-clock-interrupt-handler (os)) = '0

Event: Disable tm-rwstate-os-clock-interrupt-handler.

Theorem: tm-clock-os-clock-interrupt-handler tm-clock (os-clock-interrupt-handler (os)) = '1000

Event: Disable tm-clock-os-clock-interrupt-handler.

Theorem: tm-iports-os-clock-interrupt-handler tm-iports (os-clock-interrupt-handler (os)) = tm-iports (os)

Event: Disable tm-iports-os-clock-interrupt-handler.

Theorem: tm-oports-os-clock-interrupt-handler tm-oports (os-clock-interrupt-handler (os)) = tm-oports (os)

Event: Disable tm-oports-os-clock-interrupt-handler.

Theorem: correctness-of-clock-interrupt-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (mapup-os (os-clock-interrupt-handler (os))

= ak-clock-interrupt-handler (mapup-os (os)))

Event: Disable correctness-of-clock-interrupt-handler.

Theorem: mapup-base-os-error-handler-path1 good-os (os) → (mapup-base (taskid, os-error-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-error-handler-path1.

Theorem: mapup-limit-os-error-handler-path1 good-os (os) → (mapup-limit (taskid, os-error-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-error-handler-path1.

Theorem: getseg-tm-memory-os-error-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-error-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-error-handler-path1.

Theorem: mapup-cpu-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-error-handler-path1 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-error-handler-path1.

Theorem: mapup-regs-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-error-handler-path1 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-error-handler-path1.

Theorem: mapup-cc-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-error-handler-path1 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-error-handler-path1.

Theorem: mapup-error-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-error-handler-path1 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-error-handler-path1.

Theorem: mapup-svcflag-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-error-handler-path1 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-error-handler-path1.

Theorem: mapup-svcid-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-error-handler-path1 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-error-handler-path1.

Theorem: mapup-task-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-error-handler-path1 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-error-handler-path1.

Theorem: mapup-tasks-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-error-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-error-handler-path1.

Theorem: mapup-os-tasks-os-error-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-error-handler-path1 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-error-handler-path1.

Theorem: mapup-os-ibuffers-os-error-handler-path1 good-os (os) → (mapup-os-ibuffers (os-error-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-error-handler-path1.

Theorem: mapup-os-obuffers-os-error-handler-path1 good-os (os) → (mapup-os-obuffers (os-error-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-error-handler-path1.

Theorem: mapup-os-mbuffers-os-error-handler-path1 good-os (os) → (mapup-os-mbuffers (os-error-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-error-handler-path1.

Theorem: mapup-queue-os-readyq-os-error-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-error-handler-path1 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-error-handler-path1.

Theorem: mapup-os-status-table-os-error-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-error-handler-path1 (os)))

= putnth ('(1 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-error-handler-path1.

Theorem: tm-rwstate-os-error-handler-path1 tm-rwstate (os-error-handler-path1 (os)) = '1

Event: Disable tm-rwstate-os-error-handler-path1.

Theorem: tm-clock-os-error-handler-path1 tm-clock (os-error-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-error-handler-path1.

Theorem: tm-iports-os-error-handler-path1 tm-iports (os-error-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-error-handler-path1.

Theorem: tm-oports-os-error-handler-path1 tm-oports (os-error-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-error-handler-path1.

Theorem: correctness-of-os-error-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ array-qemptyp (array-deq (os-readyq (os))))) → (mapup-os (os-error-handler-path1 (os))

= ak-error-handler (mapup-os (os)))

Event: Disable correctness-of-os-error-handler-path1.

Theorem: mapup-base-os-error-handler-path2 good-os (os) → (mapup-base (taskid, os-error-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-error-handler-path2.

Theorem: mapup-limit-os-error-handler-path2 good-os (os) → (mapup-limit (taskid, os-error-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-error-handler-path2.

Theorem: getseg-tm-memory-os-error-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-error-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-error-handler-path2.

(PROVE-LEMMA
 TM-CPU-OS-ERROR-HANDLER-PATH2-CROCK
 (REWRITE)
 (IMPLIES
  (AND (GOOD-OS OS)
       (NOT (TM-WAITING OS)))
  (EQUAL
   (TM-CPU (OS-ERROR-HANDLER-PATH2 OS))
   (CONS
    (GETNTH '0
            (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                         OS))
    (CONS
     (GETNTH '1
             (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                          OS))
     (CONS
      (GETNTH '2
              (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                           OS))
      (CONS
       (GETNTH '3
               (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                            OS))
       (CONS
        (GETNTH '4
                (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                             OS))

(CONS
(GETNTH '5
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
        OS))
(CONS
(GETNTH '6
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
         OS))
(CONS
(GETNTH '7
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
          OS))
(CONS
(TM-PACK-PSW
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS))
'NIL)))))))))))
((ENABLE OS-ERROR-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4 TM-R5
TM-R6 TM-R7)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-error-handler-path2-crock.

Theorem: tm-cpu-os-error-handler-path2-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (array-deq (os-readyq (os)))

= array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-error-handler-path2 (os))

= getnth (os-current-taskid (os-error-handler-path2 (os)), table ('9, os-task-table (os-error-handler-path2 (os)))))

Theorem: tm-cpu-os-error-handler-path2-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ (array-qfirst (array-deq (os-readyq (os)))

≠ array-qfirst (os-readyq (os))))))

→ (tm-cpu (os-error-handler-path2 (os))

= getnth (os-current-taskid (os-error-handler-path2 (os)), table ('9, os-task-table (os-error-handler-path2 (os)))))

Theorem: tm-cpu-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-cpu (os-error-handler-path2 (os))

= getnth (os-current-taskid (os-error-handler-path2 (os)), table ('9, os-task-table (os-error-handler-path2 (os)))))

Event: Disable tm-cpu-os-error-handler-path2.

Theorem: mapup-cpu-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-error-handler-path2 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-error-handler-path2.

Theorem: mapup-regs-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-error-handler-path2 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-error-handler-path2.

Theorem: mapup-cc-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-error-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-error-handler-path2.

Theorem: mapup-error-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-error-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-error-handler-path2.

Theorem: mapup-svcflag-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-error-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-error-handler-path2.

Theorem: mapup-svcid-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-error-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-error-handler-path2.

Theorem: mapup-task-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-error-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-error-handler-path2.

Theorem: mapup-tasks-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os))))

∧ (taskid ∈ N))))

→ (mapup-tasks (taskid, os-error-handler-path2 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-error-handler-path2.

Theorem: mapup-os-tasks-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (mapup-os-tasks (os-error-handler-path2 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-error-handler-path2.

Theorem: mapup-os-ibuffers-os-error-handler-path2 good-os (os) → (mapup-os-ibuffers (os-error-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-error-handler-path2.

Theorem: mapup-os-obuffers-os-error-handler-path2 good-os (os) → (mapup-os-obuffers (os-error-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-error-handler-path2.

Theorem: mapup-os-mbuffers-os-error-handler-path2 good-os (os) → (mapup-os-mbuffers (os-error-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-error-handler-path2.

Theorem: mapup-queue-os-readyq-os-error-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-error-handler-path2 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-error-handler-path2.

Theorem: mapup-os-status-table-os-error-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-error-handler-path2 (os)))

= putnth ('(1 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-error-handler-path2.

Theorem: tm-clock-os-error-handler-path2 tm-clock (os-error-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-error-handler-path2.

Theorem: tm-iports-os-error-handler-path2 tm-iports (os-error-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-error-handler-path2.

Theorem: tm-oports-os-error-handler-path2 tm-oports (os-error-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-error-handler-path2.

Theorem: tm-rwstate-os-error-handler-path2 tm-rwstate (os-error-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-error-handler-path2.

Theorem: correctness-of-os-error-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (mapup-os (os-error-handler-path2 (os))

= ak-error-handler (mapup-os (os)))

Event: Disable correctness-of-os-error-handler-path2.

Theorem: correctness-of-os-error-handler (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os (os-error-handler (os)) = ak-error-handler (mapup-os (os)))

Event: Disable correctness-of-os-error-handler.

Theorem: mapup-base-os-svc-send-handler-path1 good-os (os) → (mapup-base (taskid, os-svc-send-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-send-handler-path1.

Theorem: mapup-limit-os-svc-send-handler-path1 good-os (os) → (mapup-limit (taskid, os-svc-send-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-send-handler-path1.

Theorem: getseg-tm-memory-os-svc-send-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-send-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-send-handler-path1.

Theorem: mapup-cpu-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-send-handler-path1 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-send-handler-path1.

Theorem: mapup-regs-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-send-handler-path1 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-send-handler-path1.

Theorem: mapup-cc-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-send-handler-path1 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-send-handler-path1.

Theorem: mapup-error-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-send-handler-path1 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-send-handler-path1.

Theorem: mapup-svcflag-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-send-handler-path1 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-send-handler-path1.

Theorem: mapup-svcid-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-send-handler-path1 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-send-handler-path1.

Theorem: mapup-task-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-send-handler-path1 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-send-handler-path1.

Theorem: mapup-tasks-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-svc-send-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-send-handler-path1.

Theorem: mapup-os-tasks-os-svc-send-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-send-handler-path1 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-send-handler-path1.

Theorem: mapup-os-ibuffers-os-svc-send-handler-path1 good-os (os) → (mapup-os-ibuffers (os-svc-send-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-send-handler-path1.

Theorem: mapup-os-obuffers-os-svc-send-handler-path1 good-os (os) → (mapup-os-obuffers (os-svc-send-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-send-handler-path1.

Theorem: mapup-os-mbuffers-os-svc-send-handler-path1 good-os (os) → (mapup-os-mbuffers (os-svc-send-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-send-handler-path1.

Theorem: mapup-queue-os-readyq-os-svc-send-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-send-handler-path1 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-send-handler-path1.

Theorem: mapup-os-status-table-os-svc-send-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-send-handler-path1 (os)))

= putnth (cons ('2, cons (os-destid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-send-handler-path1.

Theorem: tm-rwstate-os-svc-send-handler-path1 tm-rwstate (os-svc-send-handler-path1 (os)) = '1

Event: Disable tm-rwstate-os-svc-send-handler-path1.

Theorem: tm-clock-os-svc-send-handler-path1 tm-clock (os-svc-send-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-send-handler-path1.

Theorem: tm-iports-os-svc-send-handler-path1 tm-iports (os-svc-send-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-send-handler-path1.

Theorem: tm-oports-os-svc-send-handler-path1 tm-oports (os-svc-send-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-send-handler-path1.

Theorem: correctness-of-os-svc-send-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                     '16),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ (mapup-os (os-svc-send-handler-path1 (os))

= ak-execute-send (os-message (os), os-current-taskid (os), os-destid (os, '16), mapup-os (os)))

Event: Disable correctness-of-os-svc-send-handler-path1.

Theorem: mapup-base-os-svc-send-handler-path2 good-os (os)

→ (mapup-base (taskid, os-svc-send-handler-path2 (os)) = mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-send-handler-path2.

Theorem: mapup-limit-os-svc-send-handler-path2 good-os (os) → (mapup-limit (taskid, os-svc-send-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-send-handler-path2.

Theorem: getseg-tm-memory-os-svc-send-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-send-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-send-handler-path2.

(PROVE-LEMMA
 TM-CPU-OS-SVC-SEND-HANDLER-PATH2-CROCK
 (REWRITE)
 (IMPLIES
  (AND (GOOD-OS OS)
       (NOT (TM-WAITING OS)))
  (EQUAL
   (TM-CPU (OS-SVC-SEND-HANDLER-PATH2 OS))
   (CONS
    (GETNTH '0
            (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                         OS))
    (CONS
     (GETNTH '1
             (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                          OS))
     (CONS
      (GETNTH '2

(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
     OS))
(CONS
(GETNTH '3
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
      OS))
(CONS
(GETNTH '4
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
       OS))
(CONS
(GETNTH '5
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
        OS))
(CONS
(GETNTH '6
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
         OS))
(CONS
(GETNTH '7
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
          OS))
(CONS
(TM-PACK-PSW
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS))
'NIL)))))))))))
((ENABLE OS-SVC-SEND-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4 TM-R5
TM-R6 TM-R7)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-svc-send-handler-path2-crock.

Theorem: tm-cpu-os-svc-send-handler-path2-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (array-deq (os-readyq (os)))

= array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-svc-send-handler-path2 (os))

= getnth (os-current-taskid (os-svc-send-handler-path2 (os)), table ('9, os-task-table (os-svc-send-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-send-handler-path2-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ (array-qfirst (array-deq (os-readyq (os))) ≠ array-qfirst (os-readyq (os))))))

→ (tm-cpu (os-svc-send-handler-path2 (os))

= getnth (os-current-taskid (os-svc-send-handler-path2 (os)), table ('9, os-task-table (os-svc-send-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-cpu (os-svc-send-handler-path2 (os))

= getnth (os-current-taskid (os-svc-send-handler-path2 (os)), table ('9, os-task-table (os-svc-send-handler-path2 (os)))))

Event: Disable tm-cpu-os-svc-send-handler-path2.

Theorem: mapup-cpu-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-svc-send-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-send-handler-path2.

Theorem: mapup-regs-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-svc-send-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-send-handler-path2.

Theorem: mapup-cc-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-svc-send-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-send-handler-path2.

Theorem: mapup-error-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-svc-send-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-send-handler-path2.

Theorem: mapup-svcflag-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-svc-send-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-send-handler-path2.

Theorem: mapup-svcid-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-svc-send-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-send-handler-path2.

Theorem: mapup-task-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-svc-send-handler-path2 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-send-handler-path2.

Theorem: mapup-tasks-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os))))

∧ (taskid ∈ N))))

→ (mapup-tasks (taskid, os-svc-send-handler-path2 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-send-handler-path2.

Theorem: mapup-os-tasks-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (mapup-os-tasks (os-svc-send-handler-path2 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-send-handler-path2.

Theorem: mapup-os-ibuffers-os-svc-send-handler-path2 good-os (os) → (mapup-os-ibuffers (os-svc-send-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-send-handler-path2.

Theorem: mapup-os-obuffers-os-svc-send-handler-path2 good-os (os) → (mapup-os-obuffers (os-svc-send-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-send-handler-path2.

Theorem: mapup-os-mbuffers-os-svc-send-handler-path2 good-os (os) → (mapup-os-mbuffers (os-svc-send-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-send-handler-path2.

Theorem: mapup-queue-os-readyq-os-svc-send-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-send-handler-path2 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-send-handler-path2.

Theorem: mapup-os-status-table-os-svc-send-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-send-handler-path2 (os)))

= putnth (cons ('2, cons (os-destid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-send-handler-path2.

Theorem: tm-clock-os-svc-send-handler-path2 tm-clock (os-svc-send-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-svc-send-handler-path2.

Theorem: tm-iports-os-svc-send-handler-path2 tm-iports (os-svc-send-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-send-handler-path2.

Theorem: tm-oports-os-svc-send-handler-path2 tm-oports (os-svc-send-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-send-handler-path2.

Theorem: tm-rwstate-os-svc-send-handler-path2 tm-rwstate (os-svc-send-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-svc-send-handler-path2.

Theorem: correctness-of-os-svc-send-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ (array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                     '16),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ (mapup-os (os-svc-send-handler-path2 (os))

= ak-execute-send (os-message (os), os-current-taskid (os), os-destid (os, '16), mapup-os (os)))

Event: Disable correctness-of-os-svc-send-handler-path2.

Theorem: mapup-base-os-svc-send-handler-path3 good-os (os) → (mapup-base (taskid, os-svc-send-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-send-handler-path3.

Theorem: mapup-limit-os-svc-send-handler-path3 good-os (os) → (mapup-limit (taskid, os-svc-send-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-send-handler-path3.

Theorem: getseg-tm-memory-os-svc-send-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-send-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-send-handler-path3.

Theorem: tm-cpu-os-svc-send-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-send-handler-path3 (os))

= putnth (tm-pack-psw (tm-cc (os), tm-error (os), '0, tm-svcid (os)),

tm-cpu (os)))

Event: Disable tm-cpu-os-svc-send-handler-path3.

Theorem: array-qfirst-os-readyq-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ array-qfullp (os-readyq (os))))) → (array-qfirst (os-readyq (os-svc-send-handler-path3 (os)))

= array-qfirst (os-readyq (os)))

Event: Disable array-qfirst-os-readyq-os-svc-send-handler-path3.

Theorem: mapup-cpu-os-svc-send-handler-path3-case1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ array-qfullp (os-readyq (os))))) → (mapup-cpu (array-qfirst (os-readyq (os)), os-svc-send-handler-path3 (os))

= putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)), os), mapup-error (array-qfirst (os-readyq (os)), os),

                           '0,

mapup-svcid (array-qfirst (os-readyq (os)), os)),

                '8,

mapup-cpu (array-qfirst (os-readyq (os)), os)))

Event: Disable mapup-cpu-os-svc-send-handler-path3-case1.

Theorem: mapup-cpu-os-svc-send-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os))))))))

→ (mapup-cpu (taskid, os-svc-send-handler-path3 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-send-handler-path3-case2.

Theorem: mapup-cpu-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-svc-send-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                '0,

mapup-svcid (taskid, os)),

                     '8,

mapup-cpu (taskid, os))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-send-handler-path3.

Theorem: mapup-regs-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-svc-send-handler-path3 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-send-handler-path3.

Theorem: mapup-cc-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-svc-send-handler-path3 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-send-handler-path3.

Theorem: mapup-error-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-svc-send-handler-path3 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-send-handler-path3.

Theorem: mapup-svcflag-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-svc-send-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-send-handler-path3.

Theorem: mapup-svcid-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-svc-send-handler-path3 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-send-handler-path3.

Theorem: mapup-task-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-svc-send-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then tm-set-svcflag ('0, mapup-task (taskid, os)) else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-send-handler-path3.

Theorem: mapup-tasks-os-svc-send-handler-path3-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N)

∧ (array-qfirst (os-readyq (os)) < taskid)))))

→ (mapup-tasks (taskid, os-svc-send-handler-path3 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-send-handler-path3-case1.

Theorem: mapup-tasks-os-svc-send-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

                 then '*1*false

else '*1*true endif))))

→ (mapup-tasks (taskid, os-svc-send-handler-path3 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os))

− taskid,

mapup-tasks (taskid, os))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-send-handler-path3-case2.

Theorem: mapup-os-tasks-os-svc-send-handler-path3-support (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ array-qfullp (os-readyq (os))))) → (mapup-os-tasks (os-svc-send-handler-path3 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os))),

array-qfirst (os-readyq (os)),

mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-send-handler-path3-support.

Theorem: mapup-os-tasks-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

= '3)))

→ (mapup-os-tasks (os-svc-send-handler-path3 (os))

= putnth (tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-send-handler-path3.

Theorem: mapup-os-ibuffers-os-svc-send-handler-path3 good-os (os) → (mapup-os-ibuffers (os-svc-send-handler-path3 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-send-handler-path3.

Theorem: mapup-os-obuffers-os-svc-send-handler-path3 good-os (os) → (mapup-os-obuffers (os-svc-send-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-send-handler-path3.

Theorem: mapup-os-mbuffers-os-svc-send-handler-path3-support (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os)))))

→ (mapup-os-mbuffers (os-svc-send-handler-path3 (os))

= enq2 (tm-r3 (os), array-qfirst (os-readyq (os)), os-destid (os, '16), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-send-handler-path3-support.

Theorem: mapup-os-mbuffers-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os)))))

→ (mapup-os-mbuffers (os-svc-send-handler-path3 (os))

= enq2 (tm-r3 (os), qfirst (mapup-queue (os-readyq (os))), os-destid (os, '16), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-send-handler-path3.

Theorem: mapup-queue-os-readyq-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-destid (os, '16), os-status-table (os))

= '3)))

→ (mapup-queue (os-readyq (os-svc-send-handler-path3 (os))) = enq (os-destid (os, '16), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-send-handler-path3.

Theorem: mapup-os-status-table-os-svc-send-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-send-handler-path3 (os)))

= putnth ('(0 0), os-destid (os, '16), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-send-handler-path3.

Theorem: tm-clock-os-svc-send-handler-path3 tm-clock (os-svc-send-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-send-handler-path3.

Theorem: tm-iports-os-svc-send-handler-path3 tm-iports (os-svc-send-handler-path3 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-send-handler-path3.

Theorem: tm-oports-os-svc-send-handler-path3 tm-oports (os-svc-send-handler-path3 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-send-handler-path3.

Theorem: tm-rwstate-os-svc-send-handler-path3 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-send-handler-path3 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-send-handler-path3.

Theorem: ak-waiting-to-receivep-mapup-os (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

              = '3)

∧ (getnth ('1 + ('2 ∗ os-destid (os, '16)), os-status-table (os)) = os-current-taskid (os))))))

→ ak-waiting-to-receivep (os-current-taskid (os), os-destid (os, '16), mapup-os (os))

Event: Disable ak-waiting-to-receivep-mapup-os.

Theorem: correctness-of-os-svc-send-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                       '16),

os)))

∧ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

                      = '3)

∧ (getnth ('1

                                + ('2

∗ os-destid (os,

                                                '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ (mapup-os (os-svc-send-handler-path3 (os))

= ak-execute-send (os-message (os), os-current-taskid (os), os-destid (os, '16), mapup-os (os)))

Event: Disable correctness-of-os-svc-send-handler-path3.

Theorem: mapup-base-os-svc-send-handler-path4 good-os (os) → (mapup-base (taskid, os-svc-send-handler-path4 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-send-handler-path4.

Theorem: mapup-limit-os-svc-send-handler-path4 good-os (os) → (mapup-limit (taskid, os-svc-send-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-send-handler-path4.

Theorem: getseg-tm-memory-os-svc-send-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-send-handler-path4 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-send-handler-path4.

Theorem: tm-cpu-os-svc-send-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-send-handler-path4 (os))

= putnth (tm-pack-psw (tm-cc (os), tm-error (os), '0, tm-svcid (os)),

                '8,

tm-cpu (os)))

Event: Disable tm-cpu-os-svc-send-handler-path4.

Theorem: mapup-cpu-os-svc-send-handler-path4-case1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-cpu (array-qfirst (os-readyq (os)), os-svc-send-handler-path4 (os))

= putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)), os), mapup-error (array-qfirst (os-readyq (os)), os),

                           '0,

mapup-svcid (array-qfirst (os-readyq (os)), os)),

                '8,

mapup-cpu (array-qfirst (os-readyq (os)), os)))

Event: Disable mapup-cpu-os-svc-send-handler-path4-case1.

Theorem: mapup-cpu-os-svc-send-handler-path4-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os)))))))

→ (mapup-cpu (taskid, os-svc-send-handler-path4 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-send-handler-path4-case2.

Theorem: mapup-cpu-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-send-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                '0,

mapup-svcid (taskid, os)),

                    '8,

mapup-cpu (taskid, os))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-send-handler-path4.

Theorem: mapup-regs-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-send-handler-path4 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-send-handler-path4.

Theorem: mapup-cc-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-send-handler-path4 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-send-handler-path4.

Theorem: mapup-error-os-svc-send-handler-path4 (good-os (os)

∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-send-handler-path4 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-send-handler-path4.

Theorem: mapup-svcflag-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-send-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-send-handler-path4.

Theorem: mapup-svcid-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-send-handler-path4 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-send-handler-path4.

Theorem: mapup-task-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-send-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os))

then tm-set-svcflag ('0, mapup-task (taskid, os))

else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-send-handler-path4.

Theorem: mapup-tasks-os-svc-send-handler-path4-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N) ∧ (array-qfirst (os-readyq (os)) < taskid)))) → (mapup-tasks (taskid, os-svc-send-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-send-handler-path4-case1.

Theorem: mapup-tasks-os-svc-send-handler-path4-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

            then '*1*false

else '*1*true endif)))

→ (mapup-tasks (taskid, os-svc-send-handler-path4 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os))

− taskid,

mapup-tasks (taskid, os))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-send-handler-path4-case2.

Theorem: mapup-os-tasks-os-svc-send-handler-path4-support (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-send-handler-path4 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os))),

array-qfirst (os-readyq (os)),

mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-send-handler-path4-support.

Theorem: mapup-os-tasks-os-svc-send-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-send-handler-path4 (os))

= putnth (tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-send-handler-path4.

Theorem: mapup-os-ibuffers-os-svc-send-handler-path4 good-os (os) → (mapup-os-ibuffers (os-svc-send-handler-path4 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-send-handler-path4.

Theorem: mapup-os-obuffers-os-svc-send-handler-path4 good-os (os) → (mapup-os-obuffers (os-svc-send-handler-path4 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-send-handler-path4.

Theorem: mapup-os-mbuffers-os-svc-send-handler-path4-support (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os)))))

→ (mapup-os-mbuffers (os-svc-send-handler-path4 (os))

= enq2 (tm-r3 (os), array-qfirst (os-readyq (os)), os-destid (os, '16), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-send-handler-path4-support.

Theorem: mapup-os-mbuffers-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-mbuffer (os-current-taskid (os), os-destid (os, '16), os)))))

→ (mapup-os-mbuffers (os-svc-send-handler-path4 (os))

= enq2 (tm-r3 (os), qfirst (mapup-queue (os-readyq (os))), os-destid (os, '16), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-send-handler-path4.

Theorem: mapup-queue-os-readyq-os-svc-send-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-send-handler-path4 (os)))

= mapup-queue (os-readyq (os)))

Event: Disable mapup-queue-os-readyq-os-svc-send-handler-path4.

Theorem: mapup-os-status-table-os-svc-send-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-send-handler-path4 (os)))

= table ('2, os-status-table (os)))

Event: Disable mapup-os-status-table-os-svc-send-handler-path4.

Theorem: tm-clock-os-svc-send-handler-path4 tm-clock (os-svc-send-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-send-handler-path4.

Theorem: tm-iports-os-svc-send-handler-path4 tm-iports (os-svc-send-handler-path4 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-send-handler-path4.

Theorem: tm-oports-os-svc-send-handler-path4 tm-oports (os-svc-send-handler-path4 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-send-handler-path4.

Theorem: tm-rwstate-os-svc-send-handler-path4 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-send-handler-path4 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-send-handler-path4.

Theorem: not-ak-waiting-to-receivep-mapup-os (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (¬ ((getnth ('2 ∗ os-destid (os, '16),

os-status-table (os))

                 = '3)

∧ (getnth ('1

                           + ('2

∗ os-destid (os,

                                           '16)),

os-status-table (os)) = os-current-taskid (os)))))))

→ (¬ ak-waiting-to-receivep (os-current-taskid (os), os-destid (os, '16), mapup-os (os)))

Event: Disable not-ak-waiting-to-receivep-mapup-os.

Theorem: correctness-of-os-svc-send-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '0)

∧ ((¬ array-qfullp (os-current-mbuffer (os-current-taskid (os),

os-destid (os,

                                                        '16),

os)))

∧ (¬ ((getnth ('2

∗ os-destid (os,

                                           '16),

os-status-table (os))

                         = '3)

∧ (getnth ('1

                                   + ('2

∗ os-destid (os,

                                                   '16)),

os-status-table (os)) = os-current-taskid (os)))))))))

→ (mapup-os (os-svc-send-handler-path4 (os))

= ak-execute-send (os-message (os), os-current-taskid (os), os-destid (os, '16), mapup-os (os)))

Event: Disable correctness-of-os-svc-send-handler-path4.

Theorem: correctness-of-os-svc-send-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '0)))) → (mapup-os (os-svc-send-handler (os))

= ak-execute-send (os-message (os), os-current-taskid (os), os-destid (os, '16), mapup-os (os)))

Event: Disable correctness-of-os-svc-send-handler.

Theorem: mapup-base-os-svc-receive-handler-path1 good-os (os) → (mapup-base (taskid, os-svc-receive-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-receive-handler-path1.

Theorem: mapup-limit-os-svc-receive-handler-path1 good-os (os) → (mapup-limit (taskid, os-svc-receive-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-receive-handler-path1.

Theorem: getseg-tm-memory-os-svc-receive-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-receive-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-receive-handler-path1.

Theorem: mapup-cpu-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-receive-handler-path1 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-receive-handler-path1.

Theorem: mapup-regs-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-receive-handler-path1 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-receive-handler-path1.

Theorem: mapup-cc-os-svc-receive-handler-path1 (good-os (os)

∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-receive-handler-path1 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-receive-handler-path1.

Theorem: mapup-error-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-receive-handler-path1 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-receive-handler-path1.

Theorem: mapup-svcflag-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-receive-handler-path1 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-receive-handler-path1.

Theorem: mapup-svcid-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-receive-handler-path1 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-receive-handler-path1.

Theorem: mapup-task-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-receive-handler-path1 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-receive-handler-path1.

Theorem: mapup-tasks-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-svc-receive-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-receive-handler-path1.

Theorem: mapup-os-tasks-os-svc-receive-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-receive-handler-path1 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-receive-handler-path1.

Theorem: mapup-os-ibuffers-os-svc-receive-handler-path1 good-os (os) → (mapup-os-ibuffers (os-svc-receive-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-receive-handler-path1.

Theorem: mapup-os-obuffers-os-svc-receive-handler-path1 good-os (os) → (mapup-os-obuffers (os-svc-receive-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-receive-handler-path1.

Theorem: mapup-os-mbuffers-os-svc-receive-handler-path1 good-os (os) → (mapup-os-mbuffers (os-svc-receive-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-receive-handler-path1.

Theorem: mapup-queue-os-readyq-os-svc-receive-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-receive-handler-path1 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-receive-handler-path1.

Theorem: mapup-os-status-table-os-svc-receive-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-receive-handler-path1 (os)))

= putnth (cons ('3, cons (os-srcid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-receive-handler-path1.

Theorem: tm-rwstate-os-svc-receive-handler-path1 tm-rwstate (os-svc-receive-handler-path1 (os)) = '1

Event: Disable tm-rwstate-os-svc-receive-handler-path1.

Theorem: tm-clock-os-svc-receive-handler-path1 tm-clock (os-svc-receive-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-receive-handler-path1.

Theorem: tm-iports-os-svc-receive-handler-path1 tm-iports (os-svc-receive-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-receive-handler-path1.

Theorem: tm-oports-os-svc-receive-handler-path1 tm-oports (os-svc-receive-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-receive-handler-path1.

Theorem: correctness-of-os-svc-receive-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                       '16),

os-current-taskid (os), os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ (mapup-os (os-svc-receive-handler-path1 (os))

= ak-execute-receive (os-srcid (os, '16), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-receive-handler-path1.

Theorem: mapup-base-os-svc-receive-handler-path2 good-os (os) → (mapup-base (taskid, os-svc-receive-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-receive-handler-path2.

Theorem: mapup-limit-os-svc-receive-handler-path2 good-os (os) → (mapup-limit (taskid, os-svc-receive-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-receive-handler-path2.

Theorem: getseg-tm-memory-os-svc-receive-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-receive-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-receive-handler-path2.

(PROVE-LEMMA
 TM-CPU-OS-SVC-RECEIVE-HANDLER-PATH2-CROCK
 (REWRITE)
 (IMPLIES
  (AND (GOOD-OS OS)
       (NOT (TM-WAITING OS)))
  (EQUAL
   (TM-CPU (OS-SVC-RECEIVE-HANDLER-PATH2 OS))
   (CONS
    (GETNTH '0
            (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                         OS))
    (CONS
     (GETNTH '1
             (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                          OS))
     (CONS
      (GETNTH '2
              (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                           OS))
      (CONS

(GETNTH '3
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
      OS))
(CONS
(GETNTH '4
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
       OS))
(CONS
(GETNTH '5
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
        OS))
(CONS
(GETNTH '6
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
         OS))
(CONS
(GETNTH '7
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
          OS))
(CONS
(TM-PACK-PSW
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS))
'NIL)))))))))))
((ENABLE OS-SVC-RECEIVE-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4
TM-R5 TM-R6 TM-R7)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-svc-receive-handler-path2-crock.

Theorem: tm-cpu-os-svc-receive-handler-path2-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (array-deq (os-readyq (os)))

= array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-svc-receive-handler-path2 (os)) = getnth (os-current-taskid (os-svc-receive-handler-path2 (os)), table ('9,

os-task-table (os-svc-receive-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-receive-handler-path2-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ (array-qfirst (array-deq (os-readyq (os))) ≠ array-qfirst (os-readyq (os))))))

→ (tm-cpu (os-svc-receive-handler-path2 (os))

= getnth (os-current-taskid (os-svc-receive-handler-path2 (os)),

table ('9, os-task-table (os-svc-receive-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-cpu (os-svc-receive-handler-path2 (os))

= getnth (os-current-taskid (os-svc-receive-handler-path2 (os)),

table ('9, os-task-table (os-svc-receive-handler-path2 (os)))))

Event: Disable tm-cpu-os-svc-receive-handler-path2.

Theorem: mapup-cpu-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-svc-receive-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-receive-handler-path2.

Theorem: mapup-regs-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-svc-receive-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-receive-handler-path2.

Theorem: mapup-cc-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-svc-receive-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-receive-handler-path2.

Theorem: mapup-error-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-svc-receive-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-receive-handler-path2.

Theorem: mapup-svcflag-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-svc-receive-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-receive-handler-path2.

Theorem: mapup-svcid-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-svc-receive-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-receive-handler-path2.

Theorem: mapup-task-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-svc-receive-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-receive-handler-path2.

Theorem: mapup-tasks-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os))))

∧ (taskid ∈ N))))

→ (mapup-tasks (taskid, os-svc-receive-handler-path2 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-receive-handler-path2.

Theorem: mapup-os-tasks-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (mapup-os-tasks (os-svc-receive-handler-path2 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-receive-handler-path2.

Theorem: mapup-os-ibuffers-os-svc-receive-handler-path2 good-os (os) → (mapup-os-ibuffers (os-svc-receive-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-receive-handler-path2.

Theorem: mapup-os-obuffers-os-svc-receive-handler-path2 good-os (os) → (mapup-os-obuffers (os-svc-receive-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-receive-handler-path2.

Theorem: mapup-os-mbuffers-os-svc-receive-handler-path2 good-os (os) → (mapup-os-mbuffers (os-svc-receive-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-receive-handler-path2.

Theorem: mapup-queue-os-readyq-os-svc-receive-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-receive-handler-path2 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-receive-handler-path2.

Theorem: mapup-os-status-table-os-svc-receive-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-receive-handler-path2 (os)))

= putnth (cons ('3, cons (os-srcid (os, '16), 'nil)), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-receive-handler-path2.

Theorem: tm-clock-os-svc-receive-handler-path2 tm-clock (os-svc-receive-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-svc-receive-handler-path2.

Theorem: tm-iports-os-svc-receive-handler-path2 tm-iports (os-svc-receive-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-receive-handler-path2.

Theorem: tm-oports-os-svc-receive-handler-path2 tm-oports (os-svc-receive-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-receive-handler-path2.

Theorem: tm-rwstate-os-svc-receive-handler-path2 tm-rwstate (os-svc-receive-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-svc-receive-handler-path2.

Theorem: correctness-of-os-svc-receive-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ (array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                      '16),

os-current-taskid (os), os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ (mapup-os (os-svc-receive-handler-path2 (os))

= ak-execute-receive (os-srcid (os, '16), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-receive-handler-path2.

Theorem: mapup-base-os-svc-receive-handler-path3 good-os (os) → (mapup-base (taskid, os-svc-receive-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-receive-handler-path3.

Theorem: mapup-limit-os-svc-receive-handler-path3 good-os (os) → (mapup-limit (taskid, os-svc-receive-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-receive-handler-path3.

Theorem: getseg-tm-memory-os-svc-receive-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-receive-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-receive-handler-path3.

Theorem: tm-cpu-os-svc-receive-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-receive-handler-path3 (os))

= putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os),

os)),

'3,

putnth (tm-pack-psw (tm-cc (os), tm-error (os),

'0,

tm-svcid (os)),

'8,

tm-cpu (os))))

Event: Disable tm-cpu-os-svc-receive-handler-path3.

Theorem: array-qfirst-os-readyq-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ array-qfullp (os-readyq (os))))) → (array-qfirst (os-readyq (os-svc-receive-handler-path3 (os)))

= array-qfirst (os-readyq (os)))

Event: Disable array-qfirst-os-readyq-os-svc-receive-handler-path3.

Theorem: mapup-cpu-os-svc-receive-handler-path3-case1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ array-qfullp (os-readyq (os))))) → (mapup-cpu (array-qfirst (os-readyq (os)),

os-svc-receive-handler-path3 (os))

= putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

'3,

putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)),

os),

mapup-error (array-qfirst (os-readyq (os)),

os),

'0,

mapup-svcid (array-qfirst (os-readyq (os)),

os)),

'8,

mapup-cpu (array-qfirst (os-readyq (os)), os))))

Event: Disable mapup-cpu-os-svc-receive-handler-path3-case1.

Theorem: mapup-cpu-os-svc-receive-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os))))))))

→ (mapup-cpu (taskid, os-svc-receive-handler-path3 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-receive-handler-path3-case2.

Theorem: mapup-cpu-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-svc-receive-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

                    '3,

putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                      '0,

mapup-svcid (taskid, os)),

                           '8,

mapup-cpu (taskid, os)))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-receive-handler-path3.

Theorem: mapup-regs-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-svc-receive-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

                    '3,

mapup-regs (taskid, os))

else mapup-regs (taskid, os) endif)

Event: Disable mapup-regs-os-svc-receive-handler-path3.

Theorem: mapup-cc-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-svc-receive-handler-path3 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-receive-handler-path3.

Theorem: mapup-error-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-svc-receive-handler-path3 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-receive-handler-path3.

Theorem: mapup-svcflag-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-svc-receive-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-receive-handler-path3.

Theorem: mapup-svcid-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-svc-receive-handler-path3 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-receive-handler-path3.

Theorem: mapup-task-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-svc-receive-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                              '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0,

mapup-task (taskid, os)))

else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-receive-handler-path3.

Theorem: mapup-tasks-os-svc-receive-handler-path3-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N)

∧ (array-qfirst (os-readyq (os)) < taskid)))))

→ (mapup-tasks (taskid, os-svc-receive-handler-path3 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-receive-handler-path3-case1.

Theorem: mapup-tasks-os-svc-receive-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qfullp (os-readyq (os)))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

                 then '*1*false

else '*1*true endif))))

→ (mapup-tasks (taskid, os-svc-receive-handler-path3 (os))

= putnth (os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                                '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0, getnth (array-qfirst (os-readyq (os))

− taskid,

mapup-tasks (taskid,

os)))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-receive-handler-path3-case2.

Theorem: mapup-os-tasks-os-svc-receive-handler-path3-support (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ array-qfullp (os-readyq (os))))) → (mapup-os-tasks (os-svc-receive-handler-path3 (os))

= putnth (os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                 '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os)))),

array-qfirst (os-readyq (os)), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-receive-handler-path3-support.

Theorem: mapup-os-tasks-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

= '2)))

→ (mapup-os-tasks (os-svc-receive-handler-path3 (os))

= putnth (os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                 '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os)))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-receive-handler-path3.

Theorem: mapup-os-ibuffers-os-svc-receive-handler-path3 good-os (os) → (mapup-os-ibuffers (os-svc-receive-handler-path3 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-receive-handler-path3.

Theorem: mapup-os-obuffers-os-svc-receive-handler-path3 good-os (os) → (mapup-os-obuffers (os-svc-receive-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-receive-handler-path3.

Theorem: mapup-os-mbuffers-os-svc-receive-handler-path3-support (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)))))

→ (mapup-os-mbuffers (os-svc-receive-handler-path3 (os))

= deq2 (os-srcid (os, '16), array-qfirst (os-readyq (os)), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-receive-handler-path3-support.

Theorem: mapup-os-mbuffers-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)))))

→ (mapup-os-mbuffers (os-svc-receive-handler-path3 (os))

= deq2 (os-srcid (os, '16), qfirst (mapup-queue (os-readyq (os))), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-receive-handler-path3.

Theorem: mapup-queue-os-readyq-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

= '2)))

→ (mapup-queue (os-readyq (os-svc-receive-handler-path3 (os))) = enq (os-srcid (os, '16), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-receive-handler-path3.

Theorem: mapup-os-status-table-os-svc-receive-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-receive-handler-path3 (os)))

= putnth ('(0 0), os-srcid (os, '16), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-receive-handler-path3.

Theorem: tm-clock-os-svc-receive-handler-path3 tm-clock (os-svc-receive-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-receive-handler-path3.

Theorem: tm-iports-os-svc-receive-handler-path3 tm-iports (os-svc-receive-handler-path3 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-receive-handler-path3.

Theorem: tm-oports-os-svc-receive-handler-path3 tm-oports (os-svc-receive-handler-path3 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-receive-handler-path3.

Theorem: tm-rwstate-os-svc-receive-handler-path3 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-receive-handler-path3 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-receive-handler-path3.

Theorem: ak-waiting-to-sendp-mapup-os (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ ((getnth ('2 ∗ os-srcid (os, '16), os-status-table (os))

              = '2)

∧ (getnth ('1 + ('2 ∗ os-srcid (os, '16)), os-status-table (os)) = os-current-taskid (os))))))

→ ak-waiting-to-sendp (os-srcid (os, '16), os-current-taskid (os), mapup-os (os))

Event: Disable ak-waiting-to-sendp-mapup-os.

Theorem: tm-set-svcflag-commutes-with-os-store-message os-store-message (msg, tm-set-svcflag (flag, tm)) = tm-set-svcflag (flag, os-store-message (msg, tm))

Event: Disable tm-set-svcflag-commutes-with-os-store-message.

Theorem: correctness-of-os-svc-receive-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                         '16),

os-current-taskid (os), os)))

∧ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                      = '2)

∧ (getnth ('1

                                + ('2

∗ os-srcid (os,

                                               '16)),

os-status-table (os)) = os-current-taskid (os))))))))

→ (mapup-os (os-svc-receive-handler-path3 (os))

= ak-execute-receive (os-srcid (os, '16), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-receive-handler-path3.

Theorem: mapup-base-os-svc-receive-handler-path4 good-os (os)

→ (mapup-base (taskid, os-svc-receive-handler-path4 (os)) = mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-receive-handler-path4.

Theorem: mapup-limit-os-svc-receive-handler-path4 good-os (os) → (mapup-limit (taskid, os-svc-receive-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-receive-handler-path4.

Theorem: getseg-tm-memory-os-svc-receive-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-receive-handler-path4 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-receive-handler-path4.

Theorem: tm-cpu-os-svc-receive-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-receive-handler-path4 (os))

= putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

               '3,

putnth (tm-pack-psw (tm-cc (os), tm-error (os),

                                 '0,

tm-svcid (os)),

                      '8,

tm-cpu (os))))

Event: Disable tm-cpu-os-svc-receive-handler-path4.

Theorem: mapup-cpu-os-svc-receive-handler-path4-case1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-cpu (array-qfirst (os-readyq (os)),

os-svc-receive-handler-path4 (os))

= putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

                '3,

putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)),

os),

mapup-error (array-qfirst (os-readyq (os)),

os),

                                  '0,

mapup-svcid (array-qfirst (os-readyq (os)),

os)),

                      '8,

mapup-cpu (array-qfirst (os-readyq (os)), os))))

Event: Disable mapup-cpu-os-svc-receive-handler-path4-case1.

Theorem: mapup-cpu-os-svc-receive-handler-path4-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os)))))))

→ (mapup-cpu (taskid, os-svc-receive-handler-path4 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-receive-handler-path4-case2.

Theorem: mapup-cpu-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-receive-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

                     '3,

putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                       '0,

mapup-svcid (taskid, os)),

                           '8,

mapup-cpu (taskid, os)))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-receive-handler-path4.

Theorem: mapup-regs-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-receive-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (array-qfirst (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)),

                     '3,

mapup-regs (taskid, os))

else mapup-regs (taskid, os) endif)

Event: Disable mapup-regs-os-svc-receive-handler-path4.

Theorem: mapup-cc-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-receive-handler-path4 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-receive-handler-path4.

Theorem: mapup-error-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-receive-handler-path4 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-receive-handler-path4.

Theorem: mapup-svcflag-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-receive-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-receive-handler-path4.

Theorem: mapup-svcid-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-receive-handler-path4 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-receive-handler-path4.

Theorem: mapup-task-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-receive-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os))

then os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                              '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0,

mapup-task (taskid, os)))

else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-receive-handler-path4.

Theorem: mapup-tasks-os-svc-receive-handler-path4-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N) ∧ (array-qfirst (os-readyq (os)) < taskid)))) → (mapup-tasks (taskid, os-svc-receive-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-receive-handler-path4-case1.

Theorem: mapup-tasks-os-svc-receive-handler-path4-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

            then '*1*false

else '*1*true endif)))

→ (mapup-tasks (taskid, os-svc-receive-handler-path4 (os))

= putnth (os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                                '16),

os-current-taskid (os), os)), tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os))

− taskid,

mapup-tasks (taskid,

os)))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-receive-handler-path4-case2.

Theorem: mapup-os-tasks-os-svc-receive-handler-path4-support (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-receive-handler-path4 (os))

= putnth (os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                 '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os)))),

array-qfirst (os-readyq (os)), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-receive-handler-path4-support.

Theorem: mapup-os-tasks-os-svc-receive-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-receive-handler-path4 (os))

= putnth (os-store-message (array-qfirst (os-current-mbuffer (os-srcid (os,

                                                 '16),

os-current-taskid (os), os)),

tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os)))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-receive-handler-path4.

Theorem: mapup-os-ibuffers-os-svc-receive-handler-path4 good-os (os) → (mapup-os-ibuffers (os-svc-receive-handler-path4 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-receive-handler-path4.

Theorem: mapup-os-obuffers-os-svc-receive-handler-path4 good-os (os) → (mapup-os-obuffers (os-svc-receive-handler-path4 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-receive-handler-path4.

Theorem: mapup-os-mbuffers-os-svc-receive-handler-path4-support (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)))))

→ (mapup-os-mbuffers (os-svc-receive-handler-path4 (os))

= deq2 (os-srcid (os, '16), array-qfirst (os-readyq (os)), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-receive-handler-path4-support.

Theorem: mapup-os-mbuffers-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-mbuffer (os-srcid (os, '16), os-current-taskid (os), os)))))

→ (mapup-os-mbuffers (os-svc-receive-handler-path4 (os))

= deq2 (os-srcid (os, '16), qfirst (mapup-queue (os-readyq (os))), mapup-os-mbuffers (os)))

Event: Disable mapup-os-mbuffers-os-svc-receive-handler-path4.

Theorem: mapup-queue-os-readyq-os-svc-receive-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-receive-handler-path4 (os)))

= mapup-queue (os-readyq (os)))

Event: Disable mapup-queue-os-readyq-os-svc-receive-handler-path4.

Theorem: mapup-os-status-table-os-svc-receive-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-receive-handler-path4 (os)))

= table ('2, os-status-table (os)))

Event: Disable mapup-os-status-table-os-svc-receive-handler-path4.

Theorem: tm-clock-os-svc-receive-handler-path4 tm-clock (os-svc-receive-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-receive-handler-path4.

Theorem: tm-iports-os-svc-receive-handler-path4 tm-iports (os-svc-receive-handler-path4 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-receive-handler-path4.

Theorem: tm-oports-os-svc-receive-handler-path4 tm-oports (os-svc-receive-handler-path4 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-receive-handler-path4.

Theorem: tm-rwstate-os-svc-receive-handler-path4 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-receive-handler-path4 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-receive-handler-path4.

Theorem: not-ak-waiting-to-sendp-mapup-os (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (¬ ((getnth ('2 ∗ os-srcid (os, '16),

os-status-table (os))

                 = '2)

∧ (getnth ('1

                           + ('2

∗ os-srcid (os, '16)), os-status-table (os)) = os-current-taskid (os)))))))

→ (¬ ak-waiting-to-sendp (os-srcid (os, '16), os-current-taskid (os), mapup-os (os)))

Event: Disable not-ak-waiting-to-sendp-mapup-os.

Theorem: correctness-of-os-svc-receive-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '1)

∧ ((¬ array-qemptyp (os-current-mbuffer (os-srcid (os,

                                                          '16),

os-current-taskid (os), os)))

∧ (¬ ((getnth ('2

∗ os-srcid (os,

                                          '16),

os-status-table (os))

                         = '2)

∧ (getnth ('1

                                   + ('2

∗ os-srcid (os,

                                                  '16)),

os-status-table (os)) = os-current-taskid (os)))))))))

→ (mapup-os (os-svc-receive-handler-path4 (os))

= ak-execute-receive (os-srcid (os, '16), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-receive-handler-path4.

Theorem: correctness-of-os-svc-receive-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '1)))) → (mapup-os (os-svc-receive-handler (os))

= ak-execute-receive (os-srcid (os, '16), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-receive-handler.

Theorem: mapup-base-os-svc-tyi-handler-path1 good-os (os) → (mapup-base (taskid, os-svc-tyi-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyi-handler-path1.

Theorem: mapup-limit-os-svc-tyi-handler-path1 good-os (os) → (mapup-limit (taskid, os-svc-tyi-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyi-handler-path1.

Theorem: getseg-tm-memory-os-svc-tyi-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyi-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyi-handler-path1.

Theorem: mapup-cpu-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-tyi-handler-path1 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyi-handler-path1.

Theorem: mapup-regs-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-tyi-handler-path1 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-tyi-handler-path1.

Theorem: mapup-cc-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-tyi-handler-path1 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyi-handler-path1.

Theorem: mapup-error-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-tyi-handler-path1 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyi-handler-path1.

Theorem: mapup-svcflag-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-tyi-handler-path1 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-tyi-handler-path1.

Theorem: mapup-svcid-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-tyi-handler-path1 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyi-handler-path1.

Theorem: mapup-task-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-tyi-handler-path1 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-tyi-handler-path1.

Theorem: mapup-tasks-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-svc-tyi-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyi-handler-path1.

Theorem: mapup-os-tasks-os-svc-tyi-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyi-handler-path1 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-tyi-handler-path1.

Theorem: mapup-os-ibuffers-os-svc-tyi-handler-path1 good-os (os) → (mapup-os-ibuffers (os-svc-tyi-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-tyi-handler-path1.

Theorem: mapup-os-obuffers-os-svc-tyi-handler-path1 good-os (os) → (mapup-os-obuffers (os-svc-tyi-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-tyi-handler-path1.

Theorem: mapup-os-mbuffers-os-svc-tyi-handler-path1 good-os (os) → (mapup-os-mbuffers (os-svc-tyi-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyi-handler-path1.

Theorem: mapup-queue-os-readyq-os-svc-tyi-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyi-handler-path1 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-tyi-handler-path1.

Theorem: mapup-os-status-table-os-svc-tyi-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyi-handler-path1 (os)))

= putnth ('(5 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-tyi-handler-path1.

Theorem: tm-rwstate-os-svc-tyi-handler-path1 tm-rwstate (os-svc-tyi-handler-path1 (os)) = '1

Event: Disable tm-rwstate-os-svc-tyi-handler-path1.

Theorem: tm-clock-os-svc-tyi-handler-path1 tm-clock (os-svc-tyi-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-tyi-handler-path1.

Theorem: tm-iports-os-svc-tyi-handler-path1 tm-iports (os-svc-tyi-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyi-handler-path1.

Theorem: tm-oports-os-svc-tyi-handler-path1 tm-oports (os-svc-tyi-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-tyi-handler-path1.

Theorem: correctness-of-os-svc-tyi-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ (mapup-os (os-svc-tyi-handler-path1 (os))

= ak-execute-input (os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyi-handler-path1.

Theorem: mapup-base-os-svc-tyi-handler-path2 good-os (os) → (mapup-base (taskid, os-svc-tyi-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyi-handler-path2.

Theorem: mapup-limit-os-svc-tyi-handler-path2 good-os (os) → (mapup-limit (taskid, os-svc-tyi-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyi-handler-path2.

Theorem: getseg-tm-memory-os-svc-tyi-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyi-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyi-handler-path2.

(PROVE-LEMMA
 TM-CPU-OS-SVC-TYI-HANDLER-PATH2-CROCK
 (REWRITE)
 (IMPLIES
  (AND (GOOD-OS OS)
       (NOT (TM-WAITING OS)))
  (EQUAL
   (TM-CPU (OS-SVC-TYI-HANDLER-PATH2 OS))
   (CONS
    (GETNTH '0
            (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                         OS))
    (CONS
     (GETNTH '1
             (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                          OS))
     (CONS
      (GETNTH '2
              (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                           OS))
      (CONS
       (GETNTH '3
               (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                            OS))
       (CONS
        (GETNTH '4
                (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                             OS))

(CONS
(GETNTH '5
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
        OS))
(CONS
(GETNTH '6
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
         OS))
(CONS
(GETNTH '7
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
          OS))
(CONS
(TM-PACK-PSW
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS))
'NIL)))))))))))
((ENABLE OS-SVC-TYI-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4 TM-R5
TM-R6 TM-R7)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-svc-tyi-handler-path2-crock.

Theorem: tm-cpu-os-svc-tyi-handler-path2-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (array-deq (os-readyq (os)))

= array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-svc-tyi-handler-path2 (os))

= getnth (os-current-taskid (os-svc-tyi-handler-path2 (os)), table ('9, os-task-table (os-svc-tyi-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-tyi-handler-path2-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ (array-qfirst (array-deq (os-readyq (os)))

≠ array-qfirst (os-readyq (os))))))

→ (tm-cpu (os-svc-tyi-handler-path2 (os))

= getnth (os-current-taskid (os-svc-tyi-handler-path2 (os)), table ('9, os-task-table (os-svc-tyi-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-cpu (os-svc-tyi-handler-path2 (os))

= getnth (os-current-taskid (os-svc-tyi-handler-path2 (os)), table ('9, os-task-table (os-svc-tyi-handler-path2 (os)))))

Event: Disable tm-cpu-os-svc-tyi-handler-path2.

Theorem: mapup-cpu-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-svc-tyi-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyi-handler-path2.

Theorem: mapup-regs-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-svc-tyi-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-tyi-handler-path2.

Theorem: mapup-cc-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-svc-tyi-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyi-handler-path2.

Theorem: mapup-error-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-svc-tyi-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyi-handler-path2.

Theorem: mapup-svcflag-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-svc-tyi-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-tyi-handler-path2.

Theorem: mapup-svcid-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-svc-tyi-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyi-handler-path2.

Theorem: mapup-task-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-svc-tyi-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-tyi-handler-path2.

Theorem: mapup-tasks-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os))))

∧ (taskid ∈ N))))

→ (mapup-tasks (taskid, os-svc-tyi-handler-path2 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyi-handler-path2.

Theorem: mapup-os-tasks-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (mapup-os-tasks (os-svc-tyi-handler-path2 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-tyi-handler-path2.

Theorem: mapup-os-ibuffers-os-svc-tyi-handler-path2 good-os (os) → (mapup-os-ibuffers (os-svc-tyi-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-tyi-handler-path2.

Theorem: mapup-os-obuffers-os-svc-tyi-handler-path2 good-os (os) → (mapup-os-obuffers (os-svc-tyi-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-tyi-handler-path2.

Theorem: mapup-os-mbuffers-os-svc-tyi-handler-path2 good-os (os) → (mapup-os-mbuffers (os-svc-tyi-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyi-handler-path2.

Theorem: mapup-queue-os-readyq-os-svc-tyi-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyi-handler-path2 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-tyi-handler-path2.

Theorem: mapup-os-status-table-os-svc-tyi-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyi-handler-path2 (os)))

= putnth ('(5 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-tyi-handler-path2.

Theorem: tm-clock-os-svc-tyi-handler-path2 tm-clock (os-svc-tyi-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-svc-tyi-handler-path2.

Theorem: tm-iports-os-svc-tyi-handler-path2 tm-iports (os-svc-tyi-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyi-handler-path2.

Theorem: tm-oports-os-svc-tyi-handler-path2 tm-oports (os-svc-tyi-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-tyi-handler-path2.

Theorem: tm-rwstate-os-svc-tyi-handler-path2 tm-rwstate (os-svc-tyi-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-svc-tyi-handler-path2.

Theorem: correctness-of-os-svc-tyi-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ (mapup-os (os-svc-tyi-handler-path2 (os))

= ak-execute-input (os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyi-handler-path2.

Theorem: mapup-base-os-svc-tyi-handler-path3 good-os (os) → (mapup-base (taskid, os-svc-tyi-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyi-handler-path3.

Theorem: mapup-limit-os-svc-tyi-handler-path3 good-os (os) → (mapup-limit (taskid, os-svc-tyi-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyi-handler-path3.

Theorem: getseg-tm-memory-os-svc-tyi-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyi-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyi-handler-path3.

Theorem: tm-cpu-os-svc-tyi-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-tyi-handler-path3 (os))

= putnth (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

               '3,

putnth (tm-pack-psw (tm-cc (os), tm-error (os),

                                 '0,

tm-svcid (os)),

                      '8,

tm-cpu (os))))

Event: Disable tm-cpu-os-svc-tyi-handler-path3.

Theorem: mapup-cpu-os-svc-tyi-handler-path3-case1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-cpu (array-qfirst (os-readyq (os)), os-svc-tyi-handler-path3 (os))

= putnth (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

                '3,

putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)),

os),

mapup-error (array-qfirst (os-readyq (os)),

os),

                                  '0,

mapup-svcid (array-qfirst (os-readyq (os)),

os)),

                      '8,

mapup-cpu (array-qfirst (os-readyq (os)), os))))

Event: Disable mapup-cpu-os-svc-tyi-handler-path3-case1.

Theorem: mapup-cpu-os-svc-tyi-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os)))))))

→ (mapup-cpu (taskid, os-svc-tyi-handler-path3 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyi-handler-path3-case2.

Theorem: mapup-cpu-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-tyi-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

                     '3,

putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                       '0,

mapup-svcid (taskid, os)),

                           '8,

mapup-cpu (taskid, os)))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-tyi-handler-path3.

Theorem: mapup-regs-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-tyi-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

                    '3,

mapup-regs (taskid, os))

else mapup-regs (taskid, os) endif)

Event: Disable mapup-regs-os-svc-tyi-handler-path3.

Theorem: mapup-cc-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-tyi-handler-path3 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyi-handler-path3.

Theorem: mapup-error-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-tyi-handler-path3 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyi-handler-path3.

Theorem: mapup-svcflag-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-tyi-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-tyi-handler-path3.

Theorem: mapup-svcid-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-tyi-handler-path3 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyi-handler-path3.

Theorem: mapup-task-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-tyi-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then os-store-message (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

tm-set-svcflag ('0,

mapup-task (taskid, os)))

else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-tyi-handler-path3.

Theorem: mapup-tasks-os-svc-tyi-handler-path3-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N) ∧ (array-qfirst (os-readyq (os)) < taskid)))) → (mapup-tasks (taskid, os-svc-tyi-handler-path3 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyi-handler-path3-case1.

Theorem: mapup-tasks-os-svc-tyi-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

             then '*1*false

else '*1*true endif)))

→ (mapup-tasks (taskid, os-svc-tyi-handler-path3 (os))

= putnth (os-store-message (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid,

os)))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-tyi-handler-path3-case2.

Theorem: mapup-os-tasks-os-svc-tyi-handler-path3-support (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyi-handler-path3 (os))

= putnth (os-store-message (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os)))),

array-qfirst (os-readyq (os)),

mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-tyi-handler-path3-support.

Theorem: mapup-os-tasks-os-svc-tyi-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyi-handler-path3 (os))

= putnth (os-store-message (array-qfirst (os-current-ibuffer (os-current-taskid (os),

os)),

tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os)))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-tyi-handler-path3.

Theorem: mapup-os-ibuffers-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))

→ (mapup-os-ibuffers (os-svc-tyi-handler-path3 (os)) = deq-ith-buffer (os-current-taskid (os), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-svc-tyi-handler-path3.

Theorem: mapup-os-obuffers-os-svc-tyi-handler-path3 good-os (os) → (mapup-os-obuffers (os-svc-tyi-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-tyi-handler-path3.

Theorem: mapup-os-mbuffers-os-svc-tyi-handler-path3 good-os (os) → (mapup-os-mbuffers (os-svc-tyi-handler-path3 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyi-handler-path3.

Theorem: mapup-queue-os-readyq-os-svc-tyi-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyi-handler-path3 (os)))

= mapup-queue (os-readyq (os)))

Event: Disable mapup-queue-os-readyq-os-svc-tyi-handler-path3.

Theorem: mapup-os-status-table-os-svc-tyi-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyi-handler-path3 (os)))

= table ('2, os-status-table (os)))

Event: Disable mapup-os-status-table-os-svc-tyi-handler-path3.

Theorem: tm-clock-os-svc-tyi-handler-path3 tm-clock (os-svc-tyi-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-tyi-handler-path3.

Theorem: tm-iports-os-svc-tyi-handler-path3 tm-iports (os-svc-tyi-handler-path3 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyi-handler-path3.

Theorem: tm-oports-os-svc-tyi-handler-path3 tm-oports (os-svc-tyi-handler-path3 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-tyi-handler-path3.

Theorem: tm-rwstate-os-svc-tyi-handler-path3 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-tyi-handler-path3 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-tyi-handler-path3.

Theorem: correctness-of-os-svc-tyi-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '3)

∧ (¬ array-qemptyp (os-current-ibuffer (os-current-taskid (os),

os)))))))

→ (mapup-os (os-svc-tyi-handler-path3 (os))

= ak-execute-input (os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyi-handler-path3.

Theorem: correctness-of-os-svc-tyi-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '3)))) → (mapup-os (os-svc-tyi-handler (os))

= ak-execute-input (os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyi-handler.

Theorem: mapup-base-os-svc-tyo-handler-path1 good-os (os) → (mapup-base (taskid, os-svc-tyo-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyo-handler-path1.

Theorem: mapup-limit-os-svc-tyo-handler-path1 good-os (os) → (mapup-limit (taskid, os-svc-tyo-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyo-handler-path1.

Theorem: getseg-tm-memory-os-svc-tyo-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyo-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyo-handler-path1.

Theorem: mapup-cpu-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-tyo-handler-path1 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyo-handler-path1.

Theorem: mapup-regs-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-tyo-handler-path1 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-tyo-handler-path1.

Theorem: mapup-cc-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-tyo-handler-path1 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyo-handler-path1.

Theorem: mapup-error-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-tyo-handler-path1 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyo-handler-path1.

Theorem: mapup-svcflag-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-tyo-handler-path1 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-tyo-handler-path1.

Theorem: mapup-svcid-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-tyo-handler-path1 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyo-handler-path1.

Theorem: mapup-task-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-tyo-handler-path1 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-tyo-handler-path1.

Theorem: mapup-tasks-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-svc-tyo-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyo-handler-path1.

Theorem: mapup-os-tasks-os-svc-tyo-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyo-handler-path1 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-tyo-handler-path1.

Theorem: mapup-os-ibuffers-os-svc-tyo-handler-path1 good-os (os) → (mapup-os-ibuffers (os-svc-tyo-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-tyo-handler-path1.

Theorem: mapup-os-obuffers-os-svc-tyo-handler-path1 good-os (os) → (mapup-os-obuffers (os-svc-tyo-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-tyo-handler-path1.

Theorem: mapup-os-mbuffers-os-svc-tyo-handler-path1 good-os (os) → (mapup-os-mbuffers (os-svc-tyo-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyo-handler-path1.

Theorem: mapup-queue-os-readyq-os-svc-tyo-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyo-handler-path1 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-tyo-handler-path1.

Theorem: mapup-os-status-table-os-svc-tyo-handler-path1 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyo-handler-path1 (os)))

= putnth ('(4 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-tyo-handler-path1.

Theorem: tm-rwstate-os-svc-tyo-handler-path1 tm-rwstate (os-svc-tyo-handler-path1 (os)) = '1

Event: Disable tm-rwstate-os-svc-tyo-handler-path1.

Theorem: tm-clock-os-svc-tyo-handler-path1 tm-clock (os-svc-tyo-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-tyo-handler-path1.

Theorem: tm-iports-os-svc-tyo-handler-path1 tm-iports (os-svc-tyo-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyo-handler-path1.

Theorem: tm-oports-os-svc-tyo-handler-path1 tm-oports (os-svc-tyo-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-tyo-handler-path1.

Theorem: mapup-queue-getnth-for-obuffers (good-os (os) ∧ (id < '16)) → (mapup-queue (getnth (id, table ('8, os-obuffers (os))))

= getnth (id, mapup-os-obuffers (os)))

Event: Disable mapup-queue-getnth-for-obuffers.

Theorem: correctness-of-array-qfullp-obuffers-instance (array-queuep (queue) ∧ ('4 = getnth ('3, queue))) → (array-qfullp (queue) = qfullp (mapup-queue (queue), '4))

Event: Disable correctness-of-array-qfullp-obuffers-instance.

Theorem: correctness-of-os-svc-tyo-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ array-qemptyp (array-deq (os-readyq (os))))))))

→ (mapup-os (os-svc-tyo-handler-path1 (os))

= ak-execute-output (os-message (os), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyo-handler-path1.

Theorem: mapup-base-os-svc-tyo-handler-path2 good-os (os) → (mapup-base (taskid, os-svc-tyo-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyo-handler-path2.

Theorem: mapup-limit-os-svc-tyo-handler-path2 good-os (os) → (mapup-limit (taskid, os-svc-tyo-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyo-handler-path2.

Theorem: getseg-tm-memory-os-svc-tyo-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyo-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyo-handler-path2.

(PROVE-LEMMA
TM-CPU-OS-SVC-TYO-HANDLER-PATH2-CROCK
(REWRITE)
(IMPLIES
 (AND (GOOD-OS OS)
      (NOT (TM-WAITING OS)))
 (EQUAL
  (TM-CPU (OS-SVC-TYO-HANDLER-PATH2 OS))
  (CONS
   (GETNTH '0
           (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                        OS))
   (CONS
    (GETNTH '1
            (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                         OS))
    (CONS
     (GETNTH '2
             (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                          OS))
     (CONS
      (GETNTH '3
              (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                           OS))
      (CONS
       (GETNTH '4
               (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                            OS))
       (CONS
        (GETNTH '5
                (OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                             OS))

(CONS
(GETNTH '6
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
         OS))
(CONS
(GETNTH '7
(OS-NEW-REGS (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
          OS))
(CONS
(TM-PACK-PSW
(OS-NEW-CC (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
           OS)
(OS-NEW-ERROR (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS)
(OS-NEW-SVCFLAG (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
                OS)
(OS-NEW-SVCID (ARRAY-QFIRST (ARRAY-DEQ (OS-READYQ OS)))
              OS))
'NIL)))))))))))
((ENABLE OS-SVC-TYO-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4 TM-R5
TM-R6 TM-R7)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-svc-tyo-handler-path2-crock.

Theorem: tm-cpu-os-svc-tyo-handler-path2-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (array-qfirst (array-deq (os-readyq (os)))

= array-qfirst (os-readyq (os)))))

→ (tm-cpu (os-svc-tyo-handler-path2 (os))

= getnth (os-current-taskid (os-svc-tyo-handler-path2 (os)), table ('9, os-task-table (os-svc-tyo-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-tyo-handler-path2-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os))))

∧ (array-qfirst (array-deq (os-readyq (os)))

≠ array-qfirst (os-readyq (os))))))

→ (tm-cpu (os-svc-tyo-handler-path2 (os))

= getnth (os-current-taskid (os-svc-tyo-handler-path2 (os)), table ('9, os-task-table (os-svc-tyo-handler-path2 (os)))))

Theorem: tm-cpu-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (tm-cpu (os-svc-tyo-handler-path2 (os))

= getnth (os-current-taskid (os-svc-tyo-handler-path2 (os)), table ('9, os-task-table (os-svc-tyo-handler-path2 (os)))))

Event: Disable tm-cpu-os-svc-tyo-handler-path2.

Theorem: mapup-cpu-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-svc-tyo-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyo-handler-path2.

Theorem: mapup-regs-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-svc-tyo-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-tyo-handler-path2.

Theorem: mapup-cc-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-svc-tyo-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyo-handler-path2.

Theorem: mapup-error-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-svc-tyo-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyo-handler-path2.

Theorem: mapup-svcflag-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-svc-tyo-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-svc-tyo-handler-path2.

Theorem: mapup-svcid-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-svc-tyo-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyo-handler-path2.

Theorem: mapup-task-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os)))) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-svc-tyo-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-svc-tyo-handler-path2.

Theorem: mapup-tasks-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ array-qemptyp (array-deq (os-readyq (os))))

∧ (taskid ∈ N))))

→ (mapup-tasks (taskid, os-svc-tyo-handler-path2 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyo-handler-path2.

Theorem: mapup-os-tasks-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))) → (mapup-os-tasks (os-svc-tyo-handler-path2 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-svc-tyo-handler-path2.

Theorem: mapup-os-ibuffers-os-svc-tyo-handler-path2 good-os (os) → (mapup-os-ibuffers (os-svc-tyo-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-tyo-handler-path2.

Theorem: mapup-os-obuffers-os-svc-tyo-handler-path2 good-os (os) → (mapup-os-obuffers (os-svc-tyo-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-svc-tyo-handler-path2.

Theorem: mapup-os-mbuffers-os-svc-tyo-handler-path2 good-os (os) → (mapup-os-mbuffers (os-svc-tyo-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyo-handler-path2.

Theorem: mapup-queue-os-readyq-os-svc-tyo-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyo-handler-path2 (os)))

= deq (mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-svc-tyo-handler-path2.

Theorem: mapup-os-status-table-os-svc-tyo-handler-path2 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyo-handler-path2 (os)))

= putnth ('(4 0), array-qfirst (os-readyq (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-svc-tyo-handler-path2.

Theorem: tm-clock-os-svc-tyo-handler-path2 tm-clock (os-svc-tyo-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-svc-tyo-handler-path2.

Theorem: tm-iports-os-svc-tyo-handler-path2 tm-iports (os-svc-tyo-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyo-handler-path2.

Theorem: tm-oports-os-svc-tyo-handler-path2 tm-oports (os-svc-tyo-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-tyo-handler-path2.

Theorem: tm-rwstate-os-svc-tyo-handler-path2 tm-rwstate (os-svc-tyo-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-svc-tyo-handler-path2.

Theorem: correctness-of-os-svc-tyo-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ (array-qfullp (os-current-obuffer (os-current-taskid (os),

os))

∧ (¬ array-qemptyp (array-deq (os-readyq (os)))))))))

→ (mapup-os (os-svc-tyo-handler-path2 (os))

= ak-execute-output (os-message (os), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyo-handler-path2.

Theorem: mapup-base-os-svc-tyo-handler-path3 good-os (os) → (mapup-base (taskid, os-svc-tyo-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyo-handler-path3.

Theorem: mapup-limit-os-svc-tyo-handler-path3 good-os (os) → (mapup-limit (taskid, os-svc-tyo-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyo-handler-path3.

Theorem: getseg-tm-memory-os-svc-tyo-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyo-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyo-handler-path3.

Theorem: tm-cpu-os-svc-tyo-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-tyo-handler-path3 (os))

= putnth (tm-pack-psw (tm-cc (os), tm-error (os), '0, tm-svcid (os)),

                '8,

tm-cpu (os)))

Event: Disable tm-cpu-os-svc-tyo-handler-path3.

Theorem: mapup-cpu-os-svc-tyo-handler-path3-case1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-cpu (array-qfirst (os-readyq (os)), os-svc-tyo-handler-path3 (os))

= putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)), os), mapup-error (array-qfirst (os-readyq (os)), os),

                           '0,

mapup-svcid (array-qfirst (os-readyq (os)), os)),

                '8,

mapup-cpu (array-qfirst (os-readyq (os)), os)))

Event: Disable mapup-cpu-os-svc-tyo-handler-path3-case1.

Theorem: mapup-cpu-os-svc-tyo-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os)))))))

→ (mapup-cpu (taskid, os-svc-tyo-handler-path3 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyo-handler-path3-case2.

Theorem: mapup-cpu-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-tyo-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                '0,

mapup-svcid (taskid, os)),

                    '8,

mapup-cpu (taskid, os))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-tyo-handler-path3.

Theorem: mapup-regs-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-tyo-handler-path3 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-tyo-handler-path3.

Theorem: mapup-cc-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-tyo-handler-path3 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyo-handler-path3.

Theorem: mapup-error-os-svc-tyo-handler-path3 (good-os (os)

∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-tyo-handler-path3 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyo-handler-path3.

Theorem: mapup-svcflag-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-tyo-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-tyo-handler-path3.

Theorem: mapup-svcid-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-tyo-handler-path3 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyo-handler-path3.

Theorem: mapup-task-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-tyo-handler-path3 (os))

= if taskid = array-qfirst (os-readyq (os))

then tm-set-svcflag ('0, mapup-task (taskid, os))

else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-tyo-handler-path3.

Theorem: mapup-tasks-os-svc-tyo-handler-path3-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N) ∧ (array-qfirst (os-readyq (os)) < taskid)))) → (mapup-tasks (taskid, os-svc-tyo-handler-path3 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyo-handler-path3-case1.

Theorem: mapup-tasks-os-svc-tyo-handler-path3-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

            then '*1*false

else '*1*true endif)))

→ (mapup-tasks (taskid, os-svc-tyo-handler-path3 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os))

− taskid,

mapup-tasks (taskid, os))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-tyo-handler-path3-case2.

Theorem: mapup-os-tasks-os-svc-tyo-handler-path3-support (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyo-handler-path3 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os))),

array-qfirst (os-readyq (os)),

mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-tyo-handler-path3-support.

Theorem: mapup-os-tasks-os-svc-tyo-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyo-handler-path3 (os))

= putnth (tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-tyo-handler-path3.

Theorem: mapup-os-ibuffers-os-svc-tyo-handler-path3 good-os (os) → (mapup-os-ibuffers (os-svc-tyo-handler-path3 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-tyo-handler-path3.

Theorem: mapup-os-obuffers-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))))

→ (mapup-os-obuffers (os-svc-tyo-handler-path3 (os))

= enq-ith-buffer (os-message (os), os-current-taskid (os), mapup-os-obuffers (os)))

Event: Disable mapup-os-obuffers-os-svc-tyo-handler-path3.

Theorem: mapup-os-mbuffers-os-svc-tyo-handler-path3 good-os (os) → (mapup-os-mbuffers (os-svc-tyo-handler-path3 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyo-handler-path3.

Theorem: mapup-queue-os-readyq-os-svc-tyo-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyo-handler-path3 (os)))

= mapup-queue (os-readyq (os)))

Event: Disable mapup-queue-os-readyq-os-svc-tyo-handler-path3.

Theorem: mapup-os-status-table-os-svc-tyo-handler-path3 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyo-handler-path3 (os)))

= table ('2, os-status-table (os)))

Event: Disable mapup-os-status-table-os-svc-tyo-handler-path3.

Theorem: tm-clock-os-svc-tyo-handler-path3 tm-clock (os-svc-tyo-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-tyo-handler-path3.

Theorem: tm-iports-os-svc-tyo-handler-path3 tm-iports (os-svc-tyo-handler-path3 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyo-handler-path3.

Theorem: tm-oports-os-svc-tyo-handler-path3 tm-oports (os-svc-tyo-handler-path3 (os)) = tm-post-output-interrupt (array-qfirst (os-readyq (os)), tm-oports (os))

Event: Disable tm-oports-os-svc-tyo-handler-path3.

Theorem: tm-rwstate-os-svc-tyo-handler-path3 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-tyo-handler-path3 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-tyo-handler-path3.

Theorem: correctness-of-os-svc-tyo-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os)))))))

→ (mapup-os (os-svc-tyo-handler-path3 (os))

= ak-execute-output (os-message (os), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyo-handler-path3.

Theorem: mapup-base-os-svc-tyo-handler-path4 good-os (os) → (mapup-base (taskid, os-svc-tyo-handler-path4 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-svc-tyo-handler-path4.

Theorem: mapup-limit-os-svc-tyo-handler-path4 good-os (os) → (mapup-limit (taskid, os-svc-tyo-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-svc-tyo-handler-path4.

Theorem: getseg-tm-memory-os-svc-tyo-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-svc-tyo-handler-path4 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-svc-tyo-handler-path4.

Theorem: tm-cpu-os-svc-tyo-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-cpu (os-svc-tyo-handler-path4 (os))

= putnth (tm-pack-psw (tm-cc (os), tm-error (os), '0, tm-svcid (os)),

               '8,

tm-cpu (os)))

Event: Disable tm-cpu-os-svc-tyo-handler-path4.

Theorem: mapup-cpu-os-svc-tyo-handler-path4-case1 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-cpu (array-qfirst (os-readyq (os)), os-svc-tyo-handler-path4 (os))

= putnth (tm-pack-psw (mapup-cc (array-qfirst (os-readyq (os)), os), mapup-error (array-qfirst (os-readyq (os)), os),

                           '0,

mapup-svcid (array-qfirst (os-readyq (os)), os)),

               '8,

mapup-cpu (array-qfirst (os-readyq (os)), os)))

Event: Disable mapup-cpu-os-svc-tyo-handler-path4-case1.

Theorem: mapup-cpu-os-svc-tyo-handler-path4-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ ((taskid < '16)

∧ (taskid ≠ array-qfirst (os-readyq (os)))))))

→ (mapup-cpu (taskid, os-svc-tyo-handler-path4 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-svc-tyo-handler-path4-case2.

Theorem: mapup-cpu-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-svc-tyo-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os))

then putnth (tm-pack-psw (mapup-cc (taskid, os), mapup-error (taskid, os),

                                '0,

mapup-svcid (taskid, os)),

                    '8,

mapup-cpu (taskid, os))

else mapup-cpu (taskid, os) endif)

Event: Disable mapup-cpu-os-svc-tyo-handler-path4.

Theorem: mapup-regs-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-svc-tyo-handler-path4 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-svc-tyo-handler-path4.

Theorem: mapup-cc-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-svc-tyo-handler-path4 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-svc-tyo-handler-path4.

Theorem: mapup-error-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-svc-tyo-handler-path4 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-svc-tyo-handler-path4.

Theorem: mapup-svcflag-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-svc-tyo-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os)) then '0 else mapup-svcflag (taskid, os) endif)

Event: Disable mapup-svcflag-os-svc-tyo-handler-path4.

Theorem: mapup-svcid-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-svc-tyo-handler-path4 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-svc-tyo-handler-path4.

Theorem: mapup-task-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-svc-tyo-handler-path4 (os))

= if taskid = array-qfirst (os-readyq (os)) then tm-set-svcflag ('0, mapup-task (taskid, os)) else mapup-task (taskid, os) endif)

Event: Disable mapup-task-os-svc-tyo-handler-path4.

Theorem: mapup-tasks-os-svc-tyo-handler-path4-case1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N) ∧ (array-qfirst (os-readyq (os)) < taskid)))) → (mapup-tasks (taskid, os-svc-tyo-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-svc-tyo-handler-path4-case1.

Theorem: mapup-tasks-os-svc-tyo-handler-path4-case2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((taskid ∈ N)

∧ if array-qfirst (os-readyq (os)) < taskid

             then '*1*false

else '*1*true endif)))

→ (mapup-tasks (taskid, os-svc-tyo-handler-path4 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os))),

array-qfirst (os-readyq (os)) − taskid, mapup-tasks (taskid, os)))

Event: Disable mapup-tasks-os-svc-tyo-handler-path4-case2.

Theorem: mapup-os-tasks-os-svc-tyo-handler-path4-support (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyo-handler-path4 (os))

= putnth (tm-set-svcflag ('0,

getnth (array-qfirst (os-readyq (os)), mapup-os-tasks (os))),

array-qfirst (os-readyq (os)),

mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-tyo-handler-path4-support.

Theorem: mapup-os-tasks-os-svc-tyo-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-os-tasks (os-svc-tyo-handler-path4 (os))

= putnth (tm-set-svcflag ('0,

getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os))),

qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

Event: Disable mapup-os-tasks-os-svc-tyo-handler-path4.

Theorem: mapup-os-ibuffers-os-svc-tyo-handler-path4 good-os (os) → (mapup-os-ibuffers (os-svc-tyo-handler-path4 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-svc-tyo-handler-path4.

Theorem: mapup-os-obuffers-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))))

→ (mapup-os-obuffers (os-svc-tyo-handler-path4 (os))

= enq-ith-buffer (os-message (os), os-current-taskid (os), mapup-os-obuffers (os)))

Event: Disable mapup-os-obuffers-os-svc-tyo-handler-path4.

Theorem: mapup-os-mbuffers-os-svc-tyo-handler-path4 good-os (os) → (mapup-os-mbuffers (os-svc-tyo-handler-path4 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-svc-tyo-handler-path4.

Theorem: mapup-queue-os-readyq-os-svc-tyo-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (mapup-queue (os-readyq (os-svc-tyo-handler-path4 (os)))

= mapup-queue (os-readyq (os)))

Event: Disable mapup-queue-os-readyq-os-svc-tyo-handler-path4.

Theorem: mapup-os-status-table-os-svc-tyo-handler-path4 (good-os (os) ∧ (¬ tm-waiting (os))) → (table ('2, os-status-table (os-svc-tyo-handler-path4 (os)))

= table ('2, os-status-table (os)))

Event: Disable mapup-os-status-table-os-svc-tyo-handler-path4.

Theorem: tm-clock-os-svc-tyo-handler-path4 tm-clock (os-svc-tyo-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-svc-tyo-handler-path4.

Theorem: tm-iports-os-svc-tyo-handler-path4 tm-iports (os-svc-tyo-handler-path4 (os)) = tm-iports (os)

Event: Disable tm-iports-os-svc-tyo-handler-path4.

Theorem: tm-oports-os-svc-tyo-handler-path4 tm-oports (os-svc-tyo-handler-path4 (os)) = tm-oports (os)

Event: Disable tm-oports-os-svc-tyo-handler-path4.

Theorem: tm-rwstate-os-svc-tyo-handler-path4 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-svc-tyo-handler-path4 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-svc-tyo-handler-path4.

Theorem: correctness-of-os-svc-tyo-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os))

∧ (((tm-svcid (os) mod '4) = '2)

∧ ((¬ array-qfullp (os-current-obuffer (os-current-taskid (os),

os)))

∧ (¬ tm-oport-idlep (array-qfirst (os-readyq (os)),

tm-oports (os))))))))

→ (mapup-os (os-svc-tyo-handler-path4 (os))

= ak-execute-output (os-message (os), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyo-handler-path4.

Theorem: correctness-of-os-svc-tyo-handler (good-os (os) ∧ ((¬ tm-waiting (os))

∧ ((¬ tm-errorp (os)) ∧ ((tm-svcid (os) mod '4) = '2)))) → (mapup-os (os-svc-tyo-handler (os))

= ak-execute-output (os-message (os), os-current-taskid (os), mapup-os (os)))

Event: Disable correctness-of-os-svc-tyo-handler.

Theorem: mapup-base-os-waiting-input-handler-path1 good-os (os) → (mapup-base (taskid, os-waiting-input-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-input-handler-path1.

Theorem: mapup-limit-os-waiting-input-handler-path1 good-os (os) → (mapup-limit (taskid, os-waiting-input-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-input-handler-path1.

Theorem: getseg-tm-memory-os-waiting-input-handler-path1 (good-os (os) ∧ (taskid < '16))

→ (getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os-waiting-input-handler-path1 (os)))

= getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-input-handler-path1.

(PROVE-LEMMA
TM-CPU-OS-WAITING-INPUT-HANDLER-PATH1-CROCK
(REWRITE)
(EQUAL
 (TM-CPU (OS-WAITING-INPUT-HANDLER-PATH1 OS))
 (CONS
  (GETNTH '0
          (GETSEG '0
                  '8
                  (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TABLE '9 (OS-TASK-TABLE OS)))))
  (CONS
   (GETNTH '1
           (GETSEG '0
                   '8
                   (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TABLE '9 (OS-TASK-TABLE OS)))))
   (CONS
    (GETNTH '2
            (GETSEG '0
                    '8
                    (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                            (TABLE '9 (OS-TASK-TABLE OS)))))
    (CONS
     (GETNTH '3
             (GETSEG '0
                     '8
                     (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                             (TABLE '9 (OS-TASK-TABLE OS)))))
     (CONS
      (GETNTH '4
              (GETSEG '0
                      '8

(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '5
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '6
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '7
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(TM-PACK-PSW
(TM-UNPACK-CC
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-ERROR
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCFLAG
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCID
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS))))
'NIL))))))))))
((ENABLE OS-WAITING-INPUT-HANDLER-PATH1 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4

          TM-R5 TM-R6 TM-R7 TM-UNPACK-CC TM-UNPACK-ERROR TM-UNPACK-SVCFLAG
          TM-UNPACK-SVCID)
  (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable tm-cpu-os-waiting-input-handler-path1-crock.

Theorem: tm-cpu-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → (tm-cpu (os-waiting-input-handler-path1 (os))

= getnth (os-current-taskid (os-waiting-input-handler-path1 (os)),

table ('9, os-task-table (os-waiting-input-handler-path1 (os)))))

Event: Disable tm-cpu-os-waiting-input-handler-path1.

Theorem: mapup-cpu-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-waiting-input-handler-path1 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-input-handler-path1.

Theorem: mapup-regs-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-waiting-input-handler-path1 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-input-handler-path1.

Theorem: mapup-cc-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-waiting-input-handler-path1 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-input-handler-path1.

Theorem: mapup-error-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-waiting-input-handler-path1 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-input-handler-path1.

Theorem: mapup-svcflag-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-waiting-input-handler-path1 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-input-handler-path1.

Theorem: mapup-svcid-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-waiting-input-handler-path1 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-input-handler-path1.

Theorem: mapup-task-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-waiting-input-handler-path1 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-input-handler-path1.

Theorem: mapup-tasks-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-waiting-input-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-input-handler-path1.

Theorem: mapup-os-tasks-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → (mapup-os-tasks (os-waiting-input-handler-path1 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-input-handler-path1.

Theorem: mapup-os-ibuffers-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ (mapup-os-ibuffers (os-waiting-input-handler-path1 (os))

= qreplace-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-waiting-input-handler-path1.

Theorem: mapup-os-obuffers-os-waiting-input-handler-path1 good-os (os) → (mapup-os-obuffers (os-waiting-input-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-input-handler-path1.

Theorem: mapup-os-mbuffers-os-waiting-input-handler-path1 good-os (os) → (mapup-os-mbuffers (os-waiting-input-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-input-handler-path1.

Theorem: mapup-queue-os-readyq-os-waiting-input-handler-path1 (good-os (os) ∧ tm-waiting (os)) → (mapup-queue (os-readyq (os-waiting-input-handler-path1 (os)))

= enq (tm-interrupting-input-port (tm-iports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-waiting-input-handler-path1.

Theorem: mapup-os-status-table-os-waiting-input-handler-path1 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (table ('2, os-status-table (os-waiting-input-handler-path1 (os)))

= putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-waiting-input-handler-path1.

Theorem: tm-rwstate-os-waiting-input-handler-path1 tm-rwstate (os-waiting-input-handler-path1 (os)) = '0

Event: Disable tm-rwstate-os-waiting-input-handler-path1.

Theorem: tm-clock-os-waiting-input-handler-path1 tm-clock (os-waiting-input-handler-path1 (os)) = '1000

Event: Disable tm-clock-os-waiting-input-handler-path1.

Theorem: tm-iports-os-waiting-input-handler-path1 tm-iports (os-waiting-input-handler-path1 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-waiting-input-handler-path1.

Theorem: tm-oports-os-waiting-input-handler-path1 tm-oports (os-waiting-input-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-waiting-input-handler-path1.

Theorem: ak-waiting-to-inputp-mapup-os (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os)) = '5)))

→ ak-waiting-to-inputp (tm-interrupting-input-port (tm-iports (os)), mapup-os (os))

Event: Disable ak-waiting-to-inputp-mapup-os.

Theorem: correctness-of-array-qfullp-ibuffers-instance (array-queuep (queue) ∧ ('4 = getnth ('3, queue))) → (array-qfullp (queue) = qfullp (mapup-queue (queue), '4))

Event: Disable correctness-of-array-qfullp-ibuffers-instance.

Theorem: correctness-of-os-waiting-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (mapup-os (os-waiting-input-handler-path1 (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler-path1.

Theorem: mapup-base-os-waiting-input-handler-path2 good-os (os) → (mapup-base (taskid, os-waiting-input-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-input-handler-path2.

Theorem: mapup-limit-os-waiting-input-handler-path2 good-os (os) → (mapup-limit (taskid, os-waiting-input-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-input-handler-path2.

Theorem: getseg-tm-memory-os-waiting-input-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-input-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-input-handler-path2.

(PROVE-LEMMA
 TM-CPU-OS-WAITING-INPUT-HANDLER-PATH2-CROCK
 (REWRITE)
 (EQUAL
  (TM-CPU (OS-WAITING-INPUT-HANDLER-PATH2 OS))
  (CONS
   (GETNTH '0
           (GETSEG '0
                   '8
                   (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TABLE '9 (OS-TASK-TABLE OS)))))
   (CONS
    (GETNTH '1
            (GETSEG '0
                    '8
                    (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                            (TABLE '9 (OS-TASK-TABLE OS)))))
    (CONS
     (GETNTH '2
             (GETSEG '0
                     '8
                     (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                             (TABLE '9 (OS-TASK-TABLE OS)))))
     (CONS
      (GETNTH '3
              (GETSEG '0
                      '8
                      (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                              (TABLE '9 (OS-TASK-TABLE OS)))))
      (CONS
       (GETNTH '4

(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '5
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '6
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '7
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(TM-PACK-PSW
(TM-UNPACK-CC
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-ERROR
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCFLAG
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCID
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS))))

           'NIL))))))))))
 ((ENABLE OS-WAITING-INPUT-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4
          TM-R5 TM-R6 TM-R7 TM-UNPACK-CC TM-UNPACK-ERROR TM-UNPACK-SVCFLAG
          TM-UNPACK-SVCID)
  (ENABLE-THEORY TM-SHELLS GROUND-ZERO)
  (DISABLE-THEORY T)))

Event: Disable tm-cpu-os-waiting-input-handler-path2-crock.

Theorem: tm-cpu-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → (tm-cpu (os-waiting-input-handler-path2 (os))

= getnth (os-current-taskid (os-waiting-input-handler-path2 (os)),

table ('9, os-task-table (os-waiting-input-handler-path2 (os)))))

Event: Disable tm-cpu-os-waiting-input-handler-path2.

Theorem: mapup-cpu-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-waiting-input-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-input-handler-path2.

Theorem: mapup-regs-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-waiting-input-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-input-handler-path2.

Theorem: mapup-cc-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-waiting-input-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-input-handler-path2.

Theorem: mapup-error-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-waiting-input-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-input-handler-path2.

Theorem: mapup-svcflag-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-waiting-input-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-input-handler-path2.

Theorem: mapup-svcid-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-waiting-input-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-input-handler-path2.

Theorem: mapup-task-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-waiting-input-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-input-handler-path2.

Theorem: mapup-tasks-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-waiting-input-handler-path2 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-input-handler-path2.

Theorem: mapup-os-tasks-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → (mapup-os-tasks (os-waiting-input-handler-path2 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-input-handler-path2.

Theorem: mapup-os-ibuffers-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-waiting-input-handler-path2 (os))

= enq-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-waiting-input-handler-path2.

Theorem: mapup-os-obuffers-os-waiting-input-handler-path2 good-os (os) → (mapup-os-obuffers (os-waiting-input-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-input-handler-path2.

Theorem: mapup-os-mbuffers-os-waiting-input-handler-path2 good-os (os) → (mapup-os-mbuffers (os-waiting-input-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-input-handler-path2.

Theorem: mapup-queue-os-readyq-os-waiting-input-handler-path2 (good-os (os) ∧ tm-waiting (os)) → (mapup-queue (os-readyq (os-waiting-input-handler-path2 (os)))

= enq (tm-interrupting-input-port (tm-iports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-waiting-input-handler-path2.

Theorem: mapup-os-status-table-os-waiting-input-handler-path2 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (table ('2, os-status-table (os-waiting-input-handler-path2 (os)))

= putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-waiting-input-handler-path2.

Theorem: tm-rwstate-os-waiting-input-handler-path2 tm-rwstate (os-waiting-input-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-waiting-input-handler-path2.

Theorem: tm-clock-os-waiting-input-handler-path2 tm-clock (os-waiting-input-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-waiting-input-handler-path2.

Theorem: tm-iports-os-waiting-input-handler-path2 tm-iports (os-waiting-input-handler-path2 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-waiting-input-handler-path2.

Theorem: tm-oports-os-waiting-input-handler-path2 tm-oports (os-waiting-input-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-waiting-input-handler-path2.

Theorem: correctness-of-os-waiting-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (mapup-os (os-waiting-input-handler-path2 (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler-path2.

Theorem: mapup-base-os-waiting-input-handler-path3 good-os (os) → (mapup-base (taskid, os-waiting-input-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-input-handler-path3.

Theorem: mapup-limit-os-waiting-input-handler-path3 good-os (os) → (mapup-limit (taskid, os-waiting-input-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-input-handler-path3.

Theorem: getseg-tm-memory-os-waiting-input-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-input-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-input-handler-path3.

(PROVE-LEMMA
TM-CPU-OS-WAITING-INPUT-HANDLER-PATH3-CROCK
(REWRITE)
(EQUAL
 (TM-CPU (OS-WAITING-INPUT-HANDLER-PATH3 OS))
 (CONS
  (GETNTH '0
          (GETSEG '0
                  '8
                  (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                          (TABLE '9 (OS-TASK-TABLE OS)))))
  (CONS
   (GETNTH '1
           (GETSEG '0
                   '8
                   (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                           (TABLE '9 (OS-TASK-TABLE OS)))))
   (CONS
    (GETNTH '2
            (GETSEG '0
                    '8
                    (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                            (TABLE '9 (OS-TASK-TABLE OS)))))
    (CONS
     (GETNTH '3
             (GETSEG '0
                     '8
                     (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                             (TABLE '9 (OS-TASK-TABLE OS)))))
     (CONS
      (GETNTH '4
              (GETSEG '0
                      '8
                      (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                              (TABLE '9 (OS-TASK-TABLE OS)))))
      (CONS
       (GETNTH '5
               (GETSEG '0
                       '8
                       (GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
                               (TABLE '9 (OS-TASK-TABLE OS)))))
       (CONS

(GETNTH '6
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '7
(GETSEG '0
'8
(GETNTH (TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))
(TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(TM-PACK-PSW
(TM-UNPACK-CC
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-ERROR
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCFLAG
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCID
(GETNTH (PLUS '8
(TIMES '9
(TM-INTERRUPTING-INPUT-PORT (TM-IPORTS OS))))
(OS-TASK-TABLE OS))))
'NIL))))))))))
((ENABLE OS-WAITING-INPUT-HANDLER-PATH3 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4
TM-R5 TM-R6 TM-R7 TM-UNPACK-CC TM-UNPACK-ERROR TM-UNPACK-SVCFLAG
TM-UNPACK-SVCID)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-waiting-input-handler-path3-crock.

Theorem: tm-cpu-os-waiting-input-handler-path3 (good-os (os)

∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → (tm-cpu (os-waiting-input-handler-path3 (os))

= getnth (os-current-taskid (os-waiting-input-handler-path3 (os)),

table ('9, os-task-table (os-waiting-input-handler-path3 (os)))))

Event: Disable tm-cpu-os-waiting-input-handler-path3.

Theorem: mapup-cpu-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-waiting-input-handler-path3 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-input-handler-path3.

Theorem: mapup-regs-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-waiting-input-handler-path3 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-input-handler-path3.

Theorem: mapup-cc-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-waiting-input-handler-path3 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-input-handler-path3.

Theorem: mapup-error-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-waiting-input-handler-path3 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-input-handler-path3.

Theorem: mapup-svcflag-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-waiting-input-handler-path3 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-input-handler-path3.

Theorem: mapup-svcid-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-waiting-input-handler-path3 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-input-handler-path3.

Theorem: mapup-task-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-waiting-input-handler-path3 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-input-handler-path3.

Theorem: mapup-tasks-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-waiting-input-handler-path3 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-input-handler-path3.

Theorem: mapup-os-tasks-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-input-interruptp (tm-iports (os)))) → (mapup-os-tasks (os-waiting-input-handler-path3 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-input-handler-path3.

Theorem: mapup-os-ibuffers-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-waiting-input-handler-path3 (os))

= enq-ith-buffer (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-waiting-input-handler-path3.

Theorem: mapup-os-obuffers-os-waiting-input-handler-path3 good-os (os) → (mapup-os-obuffers (os-waiting-input-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-input-handler-path3.

Theorem: mapup-os-mbuffers-os-waiting-input-handler-path3 good-os (os) → (mapup-os-mbuffers (os-waiting-input-handler-path3 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-input-handler-path3.

Theorem: mapup-queue-os-readyq-os-waiting-input-handler-path3 (good-os (os) ∧ tm-waiting (os)) → (mapup-queue (os-readyq (os-waiting-input-handler-path3 (os)))

= enq (tm-interrupting-input-port (tm-iports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-waiting-input-handler-path3.

Theorem: mapup-os-status-table-os-waiting-input-handler-path3 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (table ('2, os-status-table (os-waiting-input-handler-path3 (os)))

= putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-waiting-input-handler-path3.

Theorem: tm-rwstate-os-waiting-input-handler-path3 tm-rwstate (os-waiting-input-handler-path3 (os)) = '0

Event: Disable tm-rwstate-os-waiting-input-handler-path3.

Theorem: tm-clock-os-waiting-input-handler-path3 tm-clock (os-waiting-input-handler-path3 (os)) = '1000

Event: Disable tm-clock-os-waiting-input-handler-path3.

Theorem: tm-iports-os-waiting-input-handler-path3 tm-iports (os-waiting-input-handler-path3 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-waiting-input-handler-path3.

Theorem: tm-oports-os-waiting-input-handler-path3 tm-oports (os-waiting-input-handler-path3 (os)) = tm-oports (os)

Event: Disable tm-oports-os-waiting-input-handler-path3.

Theorem: correctness-of-os-waiting-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))))))))

→ (mapup-os (os-waiting-input-handler-path3 (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler-path3.

Theorem: mapup-base-os-waiting-input-handler-path4 good-os (os) → (mapup-base (taskid, os-waiting-input-handler-path4 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-input-handler-path4.

Theorem: mapup-limit-os-waiting-input-handler-path4 good-os (os) → (mapup-limit (taskid, os-waiting-input-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-input-handler-path4.

Theorem: getseg-tm-memory-os-waiting-input-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-input-handler-path4 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-input-handler-path4.

Theorem: mapup-cpu-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-waiting-input-handler-path4 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-input-handler-path4.

Theorem: mapup-regs-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-waiting-input-handler-path4 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-input-handler-path4.

Theorem: mapup-cc-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-waiting-input-handler-path4 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-input-handler-path4.

Theorem: mapup-error-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-waiting-input-handler-path4 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-input-handler-path4.

Theorem: mapup-svcflag-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-waiting-input-handler-path4 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-input-handler-path4.

Theorem: mapup-svcid-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-waiting-input-handler-path4 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-input-handler-path4.

Theorem: mapup-task-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-waiting-input-handler-path4 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-input-handler-path4.

Theorem: mapup-tasks-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-waiting-input-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-input-handler-path4.

Theorem: mapup-os-tasks-os-waiting-input-handler-path4 (good-os (os) ∧ tm-waiting (os)) → (mapup-os-tasks (os-waiting-input-handler-path4 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-input-handler-path4.

Theorem: mapup-os-ibuffers-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ (mapup-os-ibuffers (os-waiting-input-handler-path4 (os))

= qreplace-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-waiting-input-handler-path4.

Theorem: mapup-os-obuffers-os-waiting-input-handler-path4 good-os (os) → (mapup-os-obuffers (os-waiting-input-handler-path4 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-input-handler-path4.

Theorem: mapup-os-mbuffers-os-waiting-input-handler-path4 good-os (os) → (mapup-os-mbuffers (os-waiting-input-handler-path4 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-input-handler-path4.

Theorem: tm-rwstate-os-waiting-input-handler-path4 tm-rwstate (os-waiting-input-handler-path4 (os)) = '1

Event: Disable tm-rwstate-os-waiting-input-handler-path4.

Theorem: tm-clock-os-waiting-input-handler-path4 tm-clock (os-waiting-input-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-waiting-input-handler-path4.

Theorem: tm-iports-os-waiting-input-handler-path4 tm-iports (os-waiting-input-handler-path4 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-waiting-input-handler-path4.

Theorem: tm-oports-os-waiting-input-handler-path4 tm-oports (os-waiting-input-handler-path4 (os)) = tm-oports (os)

Event: Disable tm-oports-os-waiting-input-handler-path4.

Theorem: not-ak-waiting-to-inputp-mapup-os (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os)) ≠ '5)))

→ (¬ ak-waiting-to-inputp (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable not-ak-waiting-to-inputp-mapup-os.

Theorem: correctness-of-os-waiting-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (mapup-os (os-waiting-input-handler-path4 (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler-path4.

Theorem: mapup-base-os-waiting-input-handler-path5 good-os (os) → (mapup-base (taskid, os-waiting-input-handler-path5 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-input-handler-path5.

Theorem: mapup-limit-os-waiting-input-handler-path5 good-os (os) → (mapup-limit (taskid, os-waiting-input-handler-path5 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-input-handler-path5.

Theorem: getseg-tm-memory-os-waiting-input-handler-path5 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-input-handler-path5 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-input-handler-path5.

Theorem: mapup-cpu-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-waiting-input-handler-path5 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-input-handler-path5.

Theorem: mapup-regs-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-waiting-input-handler-path5 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-input-handler-path5.

Theorem: mapup-cc-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-waiting-input-handler-path5 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-input-handler-path5.

Theorem: mapup-error-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-waiting-input-handler-path5 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-input-handler-path5.

Theorem: mapup-svcflag-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-waiting-input-handler-path5 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-input-handler-path5.

Theorem: mapup-svcid-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-waiting-input-handler-path5 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-input-handler-path5.

Theorem: mapup-task-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-waiting-input-handler-path5 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-input-handler-path5.

Theorem: mapup-tasks-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-waiting (os) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-waiting-input-handler-path5 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-input-handler-path5.

Theorem: mapup-os-tasks-os-waiting-input-handler-path5 (good-os (os) ∧ tm-waiting (os)) → (mapup-os-tasks (os-waiting-input-handler-path5 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-input-handler-path5.

Theorem: mapup-os-ibuffers-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-waiting-input-handler-path5 (os))

= enq-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-waiting-input-handler-path5.

Theorem: mapup-os-obuffers-os-waiting-input-handler-path5 good-os (os) → (mapup-os-obuffers (os-waiting-input-handler-path5 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-input-handler-path5.

Theorem: mapup-os-mbuffers-os-waiting-input-handler-path5 good-os (os) → (mapup-os-mbuffers (os-waiting-input-handler-path5 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-input-handler-path5.

Theorem: tm-rwstate-os-waiting-input-handler-path5 tm-rwstate (os-waiting-input-handler-path5 (os)) = '1

Event: Disable tm-rwstate-os-waiting-input-handler-path5.

Theorem: tm-clock-os-waiting-input-handler-path5 tm-clock (os-waiting-input-handler-path5 (os)) = tm-clock (os)

Event: Disable tm-clock-os-waiting-input-handler-path5.

Theorem: tm-iports-os-waiting-input-handler-path5 tm-iports (os-waiting-input-handler-path5 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-waiting-input-handler-path5.

Theorem: tm-oports-os-waiting-input-handler-path5 tm-oports (os-waiting-input-handler-path5 (os)) = tm-oports (os)

Event: Disable tm-oports-os-waiting-input-handler-path5.

Theorem: correctness-of-os-waiting-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (mapup-os (os-waiting-input-handler-path5 (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler-path5.

Theorem: mapup-base-os-waiting-input-handler-path6 good-os (os) → (mapup-base (taskid, os-waiting-input-handler-path6 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-input-handler-path6.

Theorem: mapup-limit-os-waiting-input-handler-path6 good-os (os) → (mapup-limit (taskid, os-waiting-input-handler-path6 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-input-handler-path6.

Theorem: getseg-tm-memory-os-waiting-input-handler-path6 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os-waiting-input-handler-path6 (os)))

= getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-input-handler-path6.

Theorem: mapup-cpu-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-waiting-input-handler-path6 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-input-handler-path6.

Theorem: mapup-regs-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-waiting-input-handler-path6 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-input-handler-path6.

Theorem: mapup-cc-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-waiting-input-handler-path6 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-input-handler-path6.

Theorem: mapup-error-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-waiting-input-handler-path6 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-input-handler-path6.

Theorem: mapup-svcflag-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-waiting-input-handler-path6 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-input-handler-path6.

Theorem: mapup-svcid-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-waiting-input-handler-path6 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-input-handler-path6.

Theorem: mapup-task-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-waiting-input-handler-path6 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-input-handler-path6.

Theorem: mapup-tasks-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-waiting (os) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-waiting-input-handler-path6 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-input-handler-path6.

Theorem: mapup-os-tasks-os-waiting-input-handler-path6 (good-os (os) ∧ tm-waiting (os)) → (mapup-os-tasks (os-waiting-input-handler-path6 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-input-handler-path6.

Theorem: mapup-os-ibuffers-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-waiting-input-handler-path6 (os))

= enq-ith-buffer (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-waiting-input-handler-path6.

Theorem: mapup-os-obuffers-os-waiting-input-handler-path6 good-os (os) → (mapup-os-obuffers (os-waiting-input-handler-path6 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-input-handler-path6.

Theorem: mapup-os-mbuffers-os-waiting-input-handler-path6 good-os (os) → (mapup-os-mbuffers (os-waiting-input-handler-path6 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-input-handler-path6.

Theorem: tm-rwstate-os-waiting-input-handler-path6 tm-rwstate (os-waiting-input-handler-path6 (os)) = '1

Event: Disable tm-rwstate-os-waiting-input-handler-path6.

Theorem: tm-clock-os-waiting-input-handler-path6 tm-clock (os-waiting-input-handler-path6 (os)) = tm-clock (os)

Event: Disable tm-clock-os-waiting-input-handler-path6.

Theorem: tm-iports-os-waiting-input-handler-path6 tm-iports (os-waiting-input-handler-path6 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-waiting-input-handler-path6.

Theorem: tm-oports-os-waiting-input-handler-path6 tm-oports (os-waiting-input-handler-path6 (os)) = tm-oports (os)

Event: Disable tm-oports-os-waiting-input-handler-path6.

Theorem: correctness-of-os-waiting-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (mapup-os (os-waiting-input-handler-path6 (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler-path6.

Theorem: correctness-of-os-waiting-input-handler (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ tm-waiting (os))) → (mapup-os (os-waiting-input-handler (os))

= ak-waiting-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-input-handler.

Theorem: mapup-base-os-running-input-handler-path1 good-os (os) → (mapup-base (taskid, os-running-input-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-input-handler-path1.

Theorem: mapup-limit-os-running-input-handler-path1 good-os (os) → (mapup-limit (taskid, os-running-input-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-input-handler-path1.

Theorem: getseg-tm-memory-os-running-input-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-input-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-input-handler-path1.

Theorem: tm-cpu-os-running-input-handler-path1-crock tm-cpu (os-running-input-handler-path1 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-input-handler-path1-crock.

Theorem: tm-cpu-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-cpu (os-running-input-handler-path1 (os))

= getnth (os-current-taskid (os-running-input-handler-path1 (os)),

table ('9, os-task-table (os-running-input-handler-path1 (os)))))

Event: Disable tm-cpu-os-running-input-handler-path1.

Theorem: mapup-cpu-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cpu (taskid, os-running-input-handler-path1 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-input-handler-path1.

Theorem: mapup-regs-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-regs (taskid, os-running-input-handler-path1 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-input-handler-path1.

Theorem: mapup-cc-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cc (taskid, os-running-input-handler-path1 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-input-handler-path1.

Theorem: mapup-error-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-error (taskid, os-running-input-handler-path1 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-input-handler-path1.

Theorem: mapup-svcflag-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcflag (taskid, os-running-input-handler-path1 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-input-handler-path1.

Theorem: mapup-svcid-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcid (taskid, os-running-input-handler-path1 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-input-handler-path1.

Theorem: mapup-task-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-task (taskid, os-running-input-handler-path1 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-input-handler-path1.

Theorem: mapup-tasks-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ (taskid ∈ N)))))

→ (mapup-tasks (taskid, os-running-input-handler-path1 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-input-handler-path1.

Theorem: mapup-os-tasks-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (mapup-os-tasks (os-running-input-handler-path1 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-input-handler-path1.

Theorem: mapup-os-ibuffers-os-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ (mapup-os-ibuffers (os-running-input-handler-path1 (os))

= qreplace-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-running-input-handler-path1.

Theorem: mapup-os-obuffers-os-running-input-handler-path1 good-os (os) → (mapup-os-obuffers (os-running-input-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-input-handler-path1.

Theorem: mapup-os-mbuffers-os-running-input-handler-path1 good-os (os) → (mapup-os-mbuffers (os-running-input-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-input-handler-path1.

Theorem: mapup-queue-os-readyq-os-running-input-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (mapup-queue (os-readyq (os-running-input-handler-path1 (os)))

= enq (tm-interrupting-input-port (tm-iports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-running-input-handler-path1.

Theorem: mapup-os-status-table-os-running-input-handler-path1 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (table ('2, os-status-table (os-running-input-handler-path1 (os)))

= putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-running-input-handler-path1.

Theorem: tm-rwstate-os-running-input-handler-path1 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-input-handler-path1 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-input-handler-path1.

Theorem: tm-clock-os-running-input-handler-path1 tm-clock (os-running-input-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-input-handler-path1.

Theorem: tm-iports-os-running-input-handler-path1 tm-iports (os-running-input-handler-path1 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-running-input-handler-path1.

Theorem: tm-oports-os-running-input-handler-path1 tm-oports (os-running-input-handler-path1 (os)) = tm-oports (os)

Event: Disable tm-oports-os-running-input-handler-path1.

Theorem: correctness-of-os-running-input-handler-path1 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (mapup-os (os-running-input-handler-path1 (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler-path1.

Theorem: mapup-base-os-running-input-handler-path2 good-os (os) → (mapup-base (taskid, os-running-input-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-input-handler-path2.

Theorem: mapup-limit-os-running-input-handler-path2 good-os (os) → (mapup-limit (taskid, os-running-input-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-input-handler-path2.

Theorem: getseg-tm-memory-os-running-input-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-input-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-input-handler-path2.

Theorem: tm-cpu-os-running-input-handler-path2-crock tm-cpu (os-running-input-handler-path2 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-input-handler-path2-crock.

Theorem: tm-cpu-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-cpu (os-running-input-handler-path2 (os))

= getnth (os-current-taskid (os-running-input-handler-path2 (os)),

table ('9, os-task-table (os-running-input-handler-path2 (os)))))

Event: Disable tm-cpu-os-running-input-handler-path2.

Theorem: mapup-cpu-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cpu (taskid, os-running-input-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-input-handler-path2.

Theorem: mapup-regs-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-regs (taskid, os-running-input-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-input-handler-path2.

Theorem: mapup-cc-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cc (taskid, os-running-input-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-input-handler-path2.

Theorem: mapup-error-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-error (taskid, os-running-input-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-input-handler-path2.

Theorem: mapup-svcflag-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcflag (taskid, os-running-input-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-input-handler-path2.

Theorem: mapup-svcid-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcid (taskid, os-running-input-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-input-handler-path2.

Theorem: mapup-task-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-task (taskid, os-running-input-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-input-handler-path2.

Theorem: mapup-tasks-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ (taskid ∈ N)))))

→ (mapup-tasks (taskid, os-running-input-handler-path2 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-input-handler-path2.

Theorem: mapup-os-tasks-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (mapup-os-tasks (os-running-input-handler-path2 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-input-handler-path2.

Theorem: mapup-os-ibuffers-os-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-running-input-handler-path2 (os))

= enq-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-running-input-handler-path2.

Theorem: mapup-os-obuffers-os-running-input-handler-path2 good-os (os) → (mapup-os-obuffers (os-running-input-handler-path2 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-input-handler-path2.

Theorem: mapup-os-mbuffers-os-running-input-handler-path2 good-os (os) → (mapup-os-mbuffers (os-running-input-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-input-handler-path2.

Theorem: mapup-queue-os-readyq-os-running-input-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (mapup-queue (os-readyq (os-running-input-handler-path2 (os)))

= enq (tm-interrupting-input-port (tm-iports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-running-input-handler-path2.

Theorem: mapup-os-status-table-os-running-input-handler-path2 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (table ('2, os-status-table (os-running-input-handler-path2 (os)))

= putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-running-input-handler-path2.

Theorem: tm-rwstate-os-running-input-handler-path2 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-input-handler-path2 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-input-handler-path2.

Theorem: tm-clock-os-running-input-handler-path2 tm-clock (os-running-input-handler-path2 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-input-handler-path2.

Theorem: tm-iports-os-running-input-handler-path2 tm-iports (os-running-input-handler-path2 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-running-input-handler-path2.

Theorem: tm-oports-os-running-input-handler-path2 tm-oports (os-running-input-handler-path2 (os)) = tm-oports (os)

Event: Disable tm-oports-os-running-input-handler-path2.

Theorem: correctness-of-os-running-input-handler-path2 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (mapup-os (os-running-input-handler-path2 (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler-path2.

Theorem: mapup-base-os-running-input-handler-path3 good-os (os) → (mapup-base (taskid, os-running-input-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-input-handler-path3.

Theorem: mapup-limit-os-running-input-handler-path3 good-os (os) → (mapup-limit (taskid, os-running-input-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-input-handler-path3.

Theorem: getseg-tm-memory-os-running-input-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-input-handler-path3 (os))) = getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-input-handler-path3.

Theorem: tm-cpu-os-running-input-handler-path3-crock tm-cpu (os-running-input-handler-path3 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-input-handler-path3-crock.

Theorem: tm-cpu-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (tm-cpu (os-running-input-handler-path3 (os))

= getnth (os-current-taskid (os-running-input-handler-path3 (os)),

table ('9, os-task-table (os-running-input-handler-path3 (os)))))

Event: Disable tm-cpu-os-running-input-handler-path3.

Theorem: mapup-cpu-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cpu (taskid, os-running-input-handler-path3 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-input-handler-path3.

Theorem: mapup-regs-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-regs (taskid, os-running-input-handler-path3 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-input-handler-path3.

Theorem: mapup-cc-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cc (taskid, os-running-input-handler-path3 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-input-handler-path3.

Theorem: mapup-error-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-error (taskid, os-running-input-handler-path3 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-input-handler-path3.

Theorem: mapup-svcflag-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcflag (taskid, os-running-input-handler-path3 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-input-handler-path3.

Theorem: mapup-svcid-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcid (taskid, os-running-input-handler-path3 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-input-handler-path3.

Theorem: mapup-task-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-task (taskid, os-running-input-handler-path3 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-input-handler-path3.

Theorem: mapup-tasks-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)),

os-status-table (os))

              = '5)

∧ (taskid ∈ N)))))

→ (mapup-tasks (taskid, os-running-input-handler-path3 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-input-handler-path3.

Theorem: mapup-os-tasks-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (mapup-os-tasks (os-running-input-handler-path3 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-input-handler-path3.

Theorem: mapup-os-ibuffers-os-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-running-input-handler-path3 (os))

= enq-ith-buffer (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-running-input-handler-path3.

Theorem: mapup-os-obuffers-os-running-input-handler-path3 good-os (os) → (mapup-os-obuffers (os-running-input-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-input-handler-path3.

Theorem: mapup-os-mbuffers-os-running-input-handler-path3 good-os (os)

→ (mapup-os-mbuffers (os-running-input-handler-path3 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-input-handler-path3.

Theorem: mapup-queue-os-readyq-os-running-input-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os))

∧ (getnth ('2 ∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

= '5))))

→ (mapup-queue (os-readyq (os-running-input-handler-path3 (os)))

= enq (tm-interrupting-input-port (tm-iports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-running-input-handler-path3.

Theorem: mapup-os-status-table-os-running-input-handler-path3 (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (table ('2, os-status-table (os-running-input-handler-path3 (os)))

= putnth ('(0 0), tm-interrupting-input-port (tm-iports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-running-input-handler-path3.

Theorem: tm-rwstate-os-running-input-handler-path3 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-input-handler-path3 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-input-handler-path3.

Theorem: tm-clock-os-running-input-handler-path3 tm-clock (os-running-input-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-input-handler-path3.

Theorem: tm-iports-os-running-input-handler-path3 tm-iports (os-running-input-handler-path3 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-running-input-handler-path3.

Theorem: tm-oports-os-running-input-handler-path3 tm-oports (os-running-input-handler-path3 (os)) = tm-oports (os)

Event: Disable tm-oports-os-running-input-handler-path3.

Theorem: correctness-of-os-running-input-handler-path3 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              = '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (mapup-os (os-running-input-handler-path3 (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler-path3.

Theorem: mapup-base-os-running-input-handler-path4 good-os (os) → (mapup-base (taskid, os-running-input-handler-path4 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-input-handler-path4.

Theorem: mapup-limit-os-running-input-handler-path4 good-os (os) → (mapup-limit (taskid, os-running-input-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-input-handler-path4.

Theorem: getseg-tm-memory-os-running-input-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os-running-input-handler-path4 (os)))

= getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-input-handler-path4.

Theorem: tm-cpu-os-running-input-handler-path4-crock tm-cpu (os-running-input-handler-path4 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-input-handler-path4-crock.

Theorem: tm-cpu-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-input-interruptp (tm-iports (os)))) → (tm-cpu (os-running-input-handler-path4 (os))

= getnth (os-current-taskid (os-running-input-handler-path4 (os)),

table ('9, os-task-table (os-running-input-handler-path4 (os)))))

Event: Disable tm-cpu-os-running-input-handler-path4.

Theorem: mapup-cpu-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-running-input-handler-path4 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-input-handler-path4.

Theorem: mapup-regs-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-running-input-handler-path4 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-input-handler-path4.

Theorem: mapup-cc-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-running-input-handler-path4 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-input-handler-path4.

Theorem: mapup-error-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-running-input-handler-path4 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-input-handler-path4.

Theorem: mapup-svcflag-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-running-input-handler-path4 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-input-handler-path4.

Theorem: mapup-svcid-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-running-input-handler-path4 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-input-handler-path4.

Theorem: mapup-task-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-running-input-handler-path4 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-input-handler-path4.

Theorem: mapup-tasks-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-running-input-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-input-handler-path4.

Theorem: mapup-os-tasks-os-running-input-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-input-interruptp (tm-iports (os)))) → (mapup-os-tasks (os-running-input-handler-path4 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-input-handler-path4.

Theorem: mapup-os-ibuffers-os-running-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))

→ (mapup-os-ibuffers (os-running-input-handler-path4 (os))

= qreplace-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-running-input-handler-path4.

Theorem: mapup-os-obuffers-os-running-input-handler-path4 good-os (os) → (mapup-os-obuffers (os-running-input-handler-path4 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-input-handler-path4.

Theorem: mapup-os-mbuffers-os-running-input-handler-path4 good-os (os) → (mapup-os-mbuffers (os-running-input-handler-path4 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-input-handler-path4.

Theorem: tm-rwstate-os-running-input-handler-path4 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-input-handler-path4 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-input-handler-path4.

Theorem: tm-clock-os-running-input-handler-path4 tm-clock (os-running-input-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-input-handler-path4.

Theorem: tm-iports-os-running-input-handler-path4 tm-iports (os-running-input-handler-path4 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-running-input-handler-path4.

Theorem: tm-oports-os-running-input-handler-path4 tm-oports (os-running-input-handler-path4 (os)) = tm-oports (os)

Event: Disable tm-oports-os-running-input-handler-path4.

Theorem: correctness-of-os-running-input-handler-path4 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os))))))

→ (mapup-os (os-running-input-handler-path4 (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler-path4.

Theorem: mapup-base-os-running-input-handler-path5 good-os (os) → (mapup-base (taskid, os-running-input-handler-path5 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-input-handler-path5.

Theorem: mapup-limit-os-running-input-handler-path5 good-os (os) → (mapup-limit (taskid, os-running-input-handler-path5 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-input-handler-path5.

Theorem: getseg-tm-memory-os-running-input-handler-path5 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-input-handler-path5 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-input-handler-path5.

Theorem: tm-cpu-os-running-input-handler-path5-crock tm-cpu (os-running-input-handler-path5 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-input-handler-path5-crock.

Theorem: tm-cpu-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-input-interruptp (tm-iports (os)))) → (tm-cpu (os-running-input-handler-path5 (os))

= getnth (os-current-taskid (os-running-input-handler-path5 (os)),

table ('9, os-task-table (os-running-input-handler-path5 (os)))))

Event: Disable tm-cpu-os-running-input-handler-path5.

Theorem: mapup-cpu-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-running-input-handler-path5 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-input-handler-path5.

Theorem: mapup-regs-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-running-input-handler-path5 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-input-handler-path5.

Theorem: mapup-cc-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-running-input-handler-path5 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-input-handler-path5.

Theorem: mapup-error-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-running-input-handler-path5 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-input-handler-path5.

Theorem: mapup-svcflag-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-running-input-handler-path5 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-input-handler-path5.

Theorem: mapup-svcid-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-running-input-handler-path5 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-input-handler-path5.

Theorem: mapup-task-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-running-input-handler-path5 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-input-handler-path5.

Theorem: mapup-tasks-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-running-input-handler-path5 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-input-handler-path5.

Theorem: mapup-os-tasks-os-running-input-handler-path5 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-input-interruptp (tm-iports (os)))) → (mapup-os-tasks (os-running-input-handler-path5 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-input-handler-path5.

Theorem: mapup-os-ibuffers-os-running-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-running-input-handler-path5 (os))

= enq-ith-buffer (tm-overflow-char (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os)))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-running-input-handler-path5.

Theorem: mapup-os-obuffers-os-running-input-handler-path5 good-os (os) → (mapup-os-obuffers (os-running-input-handler-path5 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-input-handler-path5.

Theorem: mapup-os-mbuffers-os-running-input-handler-path5 good-os (os) → (mapup-os-mbuffers (os-running-input-handler-path5 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-input-handler-path5.

Theorem: tm-rwstate-os-running-input-handler-path5 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-input-handler-path5 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-input-handler-path5.

Theorem: tm-clock-os-running-input-handler-path5 tm-clock (os-running-input-handler-path5 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-input-handler-path5.

Theorem: tm-iports-os-running-input-handler-path5 tm-iports (os-running-input-handler-path5 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-running-input-handler-path5.

Theorem: tm-oports-os-running-input-handler-path5 tm-oports (os-running-input-handler-path5 (os)) = tm-oports (os)

Event: Disable tm-oports-os-running-input-handler-path5.

Theorem: correctness-of-os-running-input-handler-path5 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os)))))))

→ (mapup-os (os-running-input-handler-path5 (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler-path5.

Theorem: mapup-base-os-running-input-handler-path6 good-os (os) → (mapup-base (taskid, os-running-input-handler-path6 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-input-handler-path6.

Theorem: mapup-limit-os-running-input-handler-path6 good-os (os) → (mapup-limit (taskid, os-running-input-handler-path6 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-input-handler-path6.

Theorem: getseg-tm-memory-os-running-input-handler-path6 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os-running-input-handler-path6 (os)))

= getseg (mapup-base (taskid, os), mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-input-handler-path6.

Theorem: tm-cpu-os-running-input-handler-path6-crock tm-cpu (os-running-input-handler-path6 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-input-handler-path6-crock.

Theorem: tm-cpu-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-input-interruptp (tm-iports (os)))) → (tm-cpu (os-running-input-handler-path6 (os))

= getnth (os-current-taskid (os-running-input-handler-path6 (os)),

table ('9, os-task-table (os-running-input-handler-path6 (os)))))

Event: Disable tm-cpu-os-running-input-handler-path6.

Theorem: mapup-cpu-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-running-input-handler-path6 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-input-handler-path6.

Theorem: mapup-regs-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-running-input-handler-path6 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-input-handler-path6.

Theorem: mapup-cc-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-running-input-handler-path6 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-input-handler-path6.

Theorem: mapup-error-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-running-input-handler-path6 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-input-handler-path6.

Theorem: mapup-svcflag-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-running-input-handler-path6 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-input-handler-path6.

Theorem: mapup-svcid-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-running-input-handler-path6 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-input-handler-path6.

Theorem: mapup-task-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-running-input-handler-path6 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-input-handler-path6.

Theorem: mapup-tasks-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-running-input-handler-path6 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-input-handler-path6.

Theorem: mapup-os-tasks-os-running-input-handler-path6 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-input-interruptp (tm-iports (os)))) → (mapup-os-tasks (os-running-input-handler-path6 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-input-handler-path6.

Theorem: mapup-os-ibuffers-os-running-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ (¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))))

→ (mapup-os-ibuffers (os-running-input-handler-path6 (os))

= enq-ith-buffer (tm-ichar (getnth (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))),

tm-interrupting-input-port (tm-iports (os)), mapup-os-ibuffers (os)))

Event: Disable mapup-os-ibuffers-os-running-input-handler-path6.

Theorem: mapup-os-obuffers-os-running-input-handler-path6 good-os (os) → (mapup-os-obuffers (os-running-input-handler-path6 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-input-handler-path6.

Theorem: mapup-os-mbuffers-os-running-input-handler-path6 good-os (os) → (mapup-os-mbuffers (os-running-input-handler-path6 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-input-handler-path6.

Theorem: tm-rwstate-os-running-input-handler-path6 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-input-handler-path6 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-input-handler-path6.

Theorem: tm-clock-os-running-input-handler-path6 tm-clock (os-running-input-handler-path6 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-input-handler-path6.

Theorem: tm-iports-os-running-input-handler-path6 tm-iports (os-running-input-handler-path6 (os)) = tm-clear-input-interrupt (tm-interrupting-input-port (tm-iports (os)),

tm-iports (os))

Event: Disable tm-iports-os-running-input-handler-path6.

Theorem: tm-oports-os-running-input-handler-path6 tm-oports (os-running-input-handler-path6 (os)) = tm-oports (os)

Event: Disable tm-oports-os-running-input-handler-path6.

Theorem: correctness-of-os-running-input-handler-path6 (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-input-port (tm-iports (os)), os-status-table (os))

              ≠ '5)

∧ ((¬ array-qfullp (os-current-ibuffer (tm-interrupting-input-port (tm-iports (os)), os)))

∧ (¬ tm-iport-errorp (tm-interrupting-input-port (tm-iports (os)), tm-iports (os))))))))

→ (mapup-os (os-running-input-handler-path6 (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler-path6.

Theorem: correctness-of-os-running-input-handler (good-os (os) ∧ (tm-some-input-interruptp (tm-iports (os)) ∧ (¬ tm-waiting (os)))) → (mapup-os (os-running-input-handler (os))

= ak-running-input-interrupt-handler (tm-interrupting-input-port (tm-iports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-input-handler.

Theorem: mapup-base-os-waiting-output-handler-path1 good-os (os) → (mapup-base (taskid, os-waiting-output-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-output-handler-path1.

Theorem: mapup-limit-os-waiting-output-handler-path1 good-os (os) → (mapup-limit (taskid, os-waiting-output-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-output-handler-path1.

Theorem: getseg-tm-memory-os-waiting-output-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-output-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-output-handler-path1.

(PROVE-LEMMA
TM-CPU-OS-WAITING-OUTPUT-HANDLER-PATH1-CROCK
(REWRITE)
(EQUAL
 (TM-CPU (OS-WAITING-OUTPUT-HANDLER-PATH1 OS))
 (CONS
  (GETNTH '0
          (GETSEG '0
                  '8
                  (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                          (TABLE '9 (OS-TASK-TABLE OS)))))
  (CONS
   (GETNTH '1
           (GETSEG '0
                   '8
                   (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TABLE '9 (OS-TASK-TABLE OS)))))
   (CONS
    (GETNTH '2
            (GETSEG '0
                    '8
                    (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                            (TABLE '9 (OS-TASK-TABLE OS)))))
    (CONS
     (GETNTH '3
             (GETSEG '0
                     '8
                     (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                             (TABLE '9 (OS-TASK-TABLE OS)))))
     (CONS
      (GETNTH '4
              (GETSEG '0
                      '8
                      (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                              (TABLE '9 (OS-TASK-TABLE OS)))))
      (CONS
       (GETNTH '5
               (GETSEG '0
                       '8
                       (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                               (TABLE '9 (OS-TASK-TABLE OS)))))
       (CONS
        (GETNTH '6
                (GETSEG '0

     (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
             (TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(GETNTH '7
(GETSEG '0
      '8
      (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
              (TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(TM-PACK-PSW
(TM-UNPACK-CC
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-ERROR
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCFLAG
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCID
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS))))
'NIL))))))))))
((ENABLE OS-WAITING-OUTPUT-HANDLER-PATH1 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4
TM-R5 TM-R6 TM-R7 TM-UNPACK-CC TM-UNPACK-ERROR TM-UNPACK-SVCFLAG
TM-UNPACK-SVCID)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-waiting-output-handler-path1-crock.

Theorem: tm-cpu-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-output-interruptp (tm-oports (os)))) → (tm-cpu (os-waiting-output-handler-path1 (os))

= getnth (os-current-taskid (os-waiting-output-handler-path1 (os)),

table ('9, os-task-table (os-waiting-output-handler-path1 (os)))))

Event: Disable tm-cpu-os-waiting-output-handler-path1.

Theorem: mapup-cpu-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-waiting-output-handler-path1 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-output-handler-path1.

Theorem: mapup-regs-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-waiting-output-handler-path1 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-output-handler-path1.

Theorem: mapup-cc-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-waiting-output-handler-path1 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-output-handler-path1.

Theorem: mapup-error-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-waiting-output-handler-path1 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-output-handler-path1.

Theorem: mapup-svcflag-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-waiting-output-handler-path1 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-output-handler-path1.

Theorem: mapup-svcid-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-waiting-output-handler-path1 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-output-handler-path1.

Theorem: mapup-task-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-waiting-output-handler-path1 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-output-handler-path1.

Theorem: mapup-tasks-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-waiting-output-handler-path1 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-output-handler-path1.

Theorem: mapup-os-tasks-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-output-interruptp (tm-oports (os)))) → (mapup-os-tasks (os-waiting-output-handler-path1 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-output-handler-path1.

Theorem: mapup-os-ibuffers-os-waiting-output-handler-path1 good-os (os) → (mapup-os-ibuffers (os-waiting-output-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-waiting-output-handler-path1.

Theorem: mapup-os-obuffers-os-waiting-output-handler-path1 good-os (os) → (mapup-os-obuffers (os-waiting-output-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-output-handler-path1.

Theorem: mapup-os-mbuffers-os-waiting-output-handler-path1 good-os (os) → (mapup-os-mbuffers (os-waiting-output-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-output-handler-path1.

Theorem: mapup-queue-os-readyq-os-waiting-output-handler-path1 (good-os (os) ∧ tm-waiting (os)) → (mapup-queue (os-readyq (os-waiting-output-handler-path1 (os)))

= enq (tm-interrupting-output-port (tm-oports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-waiting-output-handler-path1.

Theorem: mapup-os-status-table-os-waiting-output-handler-path1 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (table ('2, os-status-table (os-waiting-output-handler-path1 (os)))

= putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-waiting-output-handler-path1.

Theorem: tm-rwstate-os-waiting-output-handler-path1 tm-rwstate (os-waiting-output-handler-path1 (os)) = '0

Event: Disable tm-rwstate-os-waiting-output-handler-path1.

Theorem: tm-clock-os-waiting-output-handler-path1 tm-clock (os-waiting-output-handler-path1 (os)) = '1000

Event: Disable tm-clock-os-waiting-output-handler-path1.

Theorem: tm-iports-os-waiting-output-handler-path1 tm-iports (os-waiting-output-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-waiting-output-handler-path1.

Theorem: tm-oports-os-waiting-output-handler-path1 tm-oports (os-waiting-output-handler-path1 (os)) = tm-clear-output-interrupt (tm-interrupting-output-port (tm-oports (os)),

tm-oports (os))

Event: Disable tm-oports-os-waiting-output-handler-path1.

Theorem: ak-waiting-to-outputp-mapup-os (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os)) = '4)))

→ ak-waiting-to-outputp (tm-interrupting-output-port (tm-oports (os)), mapup-os (os))

Event: Disable ak-waiting-to-outputp-mapup-os.

Theorem: correctness-of-os-waiting-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (mapup-os (os-waiting-output-handler-path1 (os))

= ak-waiting-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-output-handler-path1.

Theorem: mapup-base-os-waiting-output-handler-path2 good-os (os) → (mapup-base (taskid, os-waiting-output-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-output-handler-path2.

Theorem: mapup-limit-os-waiting-output-handler-path2 good-os (os) → (mapup-limit (taskid, os-waiting-output-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-output-handler-path2.

Theorem: getseg-tm-memory-os-waiting-output-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-output-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-output-handler-path2.

(PROVE-LEMMA
 TM-CPU-OS-WAITING-OUTPUT-HANDLER-PATH2-CROCK
 (REWRITE)

(EQUAL
(TM-CPU (OS-WAITING-OUTPUT-HANDLER-PATH2 OS))
(CONS
 (GETNTH '0
         (GETSEG '0
                 '8
                 (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                         (TABLE '9 (OS-TASK-TABLE OS)))))
 (CONS
  (GETNTH '1
          (GETSEG '0
                  '8
                  (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                          (TABLE '9 (OS-TASK-TABLE OS)))))
  (CONS
   (GETNTH '2
           (GETSEG '0
                   '8
                   (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                           (TABLE '9 (OS-TASK-TABLE OS)))))
   (CONS
    (GETNTH '3
            (GETSEG '0
                    '8
                    (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                            (TABLE '9 (OS-TASK-TABLE OS)))))
    (CONS
     (GETNTH '4
             (GETSEG '0
                     '8
                     (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                             (TABLE '9 (OS-TASK-TABLE OS)))))
     (CONS
      (GETNTH '5
              (GETSEG '0
                      '8
                      (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                              (TABLE '9 (OS-TASK-TABLE OS)))))
      (CONS
       (GETNTH '6
               (GETSEG '0
                       '8
                       (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
                               (TABLE '9 (OS-TASK-TABLE OS)))))

(CONS
(GETNTH '7
(GETSEG '0
      '8
      (GETNTH (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))
              (TABLE '9 (OS-TASK-TABLE OS)))))
(CONS
(TM-PACK-PSW
(TM-UNPACK-CC
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-ERROR
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCFLAG
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS)))
(TM-UNPACK-SVCID
(GETNTH
(PLUS '8
      (TIMES '9
             (TM-INTERRUPTING-OUTPUT-PORT (TM-OPORTS OS))))
(OS-TASK-TABLE OS))))
'NIL))))))))))
((ENABLE OS-WAITING-OUTPUT-HANDLER-PATH2 TM-CPU TM-R0 TM-R1 TM-R2 TM-R3 TM-R4
TM-R5 TM-R6 TM-R7 TM-UNPACK-CC TM-UNPACK-ERROR TM-UNPACK-SVCFLAG
TM-UNPACK-SVCID)
(ENABLE-THEORY TM-SHELLS GROUND-ZERO)
(DISABLE-THEORY T)))

Event: Disable tm-cpu-os-waiting-output-handler-path2-crock.

Theorem: tm-cpu-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-output-interruptp (tm-oports (os))))

→ (tm-cpu (os-waiting-output-handler-path2 (os))

= getnth (os-current-taskid (os-waiting-output-handler-path2 (os)),

table ('9, os-task-table (os-waiting-output-handler-path2 (os)))))

Event: Disable tm-cpu-os-waiting-output-handler-path2.

Theorem: mapup-cpu-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-waiting-output-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-output-handler-path2.

Theorem: mapup-regs-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-waiting-output-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-output-handler-path2.

Theorem: mapup-cc-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-waiting-output-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-output-handler-path2.

Theorem: mapup-error-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-waiting-output-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-output-handler-path2.

Theorem: mapup-svcflag-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-waiting-output-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-output-handler-path2.

Theorem: mapup-svcid-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-waiting-output-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-output-handler-path2.

Theorem: mapup-task-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-waiting-output-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-output-handler-path2.

Theorem: mapup-tasks-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os)

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-waiting-output-handler-path2 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-output-handler-path2.

Theorem: mapup-os-tasks-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-waiting (os) ∧ tm-some-output-interruptp (tm-oports (os)))) → (mapup-os-tasks (os-waiting-output-handler-path2 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-output-handler-path2.

Theorem: mapup-os-ibuffers-os-waiting-output-handler-path2 good-os (os) → (mapup-os-ibuffers (os-waiting-output-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-waiting-output-handler-path2.

Theorem: mapup-os-obuffers-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (mapup-os-obuffers (os-waiting-output-handler-path2 (os))

= deq-ith-buffer (tm-interrupting-output-port (tm-oports (os)), mapup-os-obuffers (os)))

Event: Disable mapup-os-obuffers-os-waiting-output-handler-path2.

Theorem: mapup-os-mbuffers-os-waiting-output-handler-path2 good-os (os) → (mapup-os-mbuffers (os-waiting-output-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-output-handler-path2.

Theorem: mapup-queue-os-readyq-os-waiting-output-handler-path2 (good-os (os) ∧ tm-waiting (os)) → (mapup-queue (os-readyq (os-waiting-output-handler-path2 (os)))

= enq (tm-interrupting-output-port (tm-oports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-waiting-output-handler-path2.

Theorem: mapup-os-status-table-os-waiting-output-handler-path2 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os)))

→ (table ('2, os-status-table (os-waiting-output-handler-path2 (os)))

= putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-waiting-output-handler-path2.

Theorem: tm-rwstate-os-waiting-output-handler-path2 tm-rwstate (os-waiting-output-handler-path2 (os)) = '0

Event: Disable tm-rwstate-os-waiting-output-handler-path2.

Theorem: tm-clock-os-waiting-output-handler-path2 tm-clock (os-waiting-output-handler-path2 (os)) = '1000

Event: Disable tm-clock-os-waiting-output-handler-path2.

Theorem: tm-iports-os-waiting-output-handler-path2 tm-iports (os-waiting-output-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-waiting-output-handler-path2.

Theorem: tm-oports-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-oports (os-waiting-output-handler-path2 (os))

= tm-start-output (qfirst (getnth (tm-interrupting-output-port (tm-oports (os)),

mapup-os-obuffers (os))),

tm-interrupting-output-port (tm-oports (os)), tm-oports (os)))

Event: Disable tm-oports-os-waiting-output-handler-path2.

Theorem: correctness-of-os-waiting-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (mapup-os (os-waiting-output-handler-path2 (os))

= ak-waiting-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-output-handler-path2.

Theorem: mapup-base-os-waiting-output-handler-path3 good-os (os) → (mapup-base (taskid, os-waiting-output-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-output-handler-path3.

Theorem: mapup-limit-os-waiting-output-handler-path3 good-os (os) → (mapup-limit (taskid, os-waiting-output-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-output-handler-path3.

Theorem: getseg-tm-memory-os-waiting-output-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-output-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-output-handler-path3.

Theorem: mapup-cpu-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-waiting-output-handler-path3 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-output-handler-path3.

Theorem: mapup-regs-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-waiting-output-handler-path3 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-output-handler-path3.

Theorem: mapup-cc-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-waiting-output-handler-path3 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-output-handler-path3.

Theorem: mapup-error-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-waiting-output-handler-path3 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-output-handler-path3.

Theorem: mapup-svcflag-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-waiting-output-handler-path3 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-output-handler-path3.

Theorem: mapup-svcid-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-waiting-output-handler-path3 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-output-handler-path3.

Theorem: mapup-task-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-waiting-output-handler-path3 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-output-handler-path3.

Theorem: mapup-tasks-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-waiting (os) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-waiting-output-handler-path3 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-output-handler-path3.

Theorem: mapup-os-tasks-os-waiting-output-handler-path3 (good-os (os) ∧ tm-waiting (os)) → (mapup-os-tasks (os-waiting-output-handler-path3 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-output-handler-path3.

Theorem: mapup-os-ibuffers-os-waiting-output-handler-path3 good-os (os) → (mapup-os-ibuffers (os-waiting-output-handler-path3 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-waiting-output-handler-path3.

Theorem: mapup-os-obuffers-os-waiting-output-handler-path3 good-os (os) → (mapup-os-obuffers (os-waiting-output-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-waiting-output-handler-path3.

Theorem: mapup-os-mbuffers-os-waiting-output-handler-path3 good-os (os) → (mapup-os-mbuffers (os-waiting-output-handler-path3 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-output-handler-path3.

Theorem: tm-rwstate-os-waiting-output-handler-path3 tm-rwstate (os-waiting-output-handler-path3 (os)) = '1

Event: Disable tm-rwstate-os-waiting-output-handler-path3.

Theorem: tm-clock-os-waiting-output-handler-path3 tm-clock (os-waiting-output-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-waiting-output-handler-path3.

Theorem: tm-iports-os-waiting-output-handler-path3 tm-iports (os-waiting-output-handler-path3 (os)) = tm-iports (os)

Event: Disable tm-iports-os-waiting-output-handler-path3.

Theorem: tm-oports-os-waiting-output-handler-path3 tm-oports (os-waiting-output-handler-path3 (os)) = tm-clear-output-interrupt (tm-interrupting-output-port (tm-oports (os)),

tm-oports (os))

Event: Disable tm-oports-os-waiting-output-handler-path3.

Theorem: not-ak-waiting-to-outputp-mapup-os (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os)) ≠ '4)))

→ (¬ ak-waiting-to-outputp (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable not-ak-waiting-to-outputp-mapup-os.

Theorem: correctness-of-os-waiting-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (mapup-os (os-waiting-output-handler-path3 (os))

= ak-waiting-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-output-handler-path3.

Theorem: mapup-base-os-waiting-output-handler-path4 good-os (os) → (mapup-base (taskid, os-waiting-output-handler-path4 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-waiting-output-handler-path4.

Theorem: mapup-limit-os-waiting-output-handler-path4 good-os (os) → (mapup-limit (taskid, os-waiting-output-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-waiting-output-handler-path4.

Theorem: getseg-tm-memory-os-waiting-output-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-waiting-output-handler-path4 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-waiting-output-handler-path4.

Theorem: mapup-cpu-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cpu (taskid, os-waiting-output-handler-path4 (os))

= mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-waiting-output-handler-path4.

Theorem: mapup-regs-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-regs (taskid, os-waiting-output-handler-path4 (os))

= mapup-regs (taskid, os))

Event: Disable mapup-regs-os-waiting-output-handler-path4.

Theorem: mapup-cc-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-cc (taskid, os-waiting-output-handler-path4 (os))

= mapup-cc (taskid, os))

Event: Disable mapup-cc-os-waiting-output-handler-path4.

Theorem: mapup-error-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-error (taskid, os-waiting-output-handler-path4 (os))

= mapup-error (taskid, os))

Event: Disable mapup-error-os-waiting-output-handler-path4.

Theorem: mapup-svcflag-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcflag (taskid, os-waiting-output-handler-path4 (os))

= mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-waiting-output-handler-path4.

Theorem: mapup-svcid-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-svcid (taskid, os-waiting-output-handler-path4 (os))

= mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-waiting-output-handler-path4.

Theorem: mapup-task-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ ((taskid ∈ N) ∧ (taskid < '16)))) → (mapup-task (taskid, os-waiting-output-handler-path4 (os))

= mapup-task (taskid, os))

Event: Disable mapup-task-os-waiting-output-handler-path4.

Theorem: mapup-tasks-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-waiting (os) ∧ (taskid ∈ N))) → (mapup-tasks (taskid, os-waiting-output-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-waiting-output-handler-path4.

Theorem: mapup-os-tasks-os-waiting-output-handler-path4 (good-os (os) ∧ tm-waiting (os)) → (mapup-os-tasks (os-waiting-output-handler-path4 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-waiting-output-handler-path4.

Theorem: mapup-os-ibuffers-os-waiting-output-handler-path4 good-os (os) → (mapup-os-ibuffers (os-waiting-output-handler-path4 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-waiting-output-handler-path4.

Theorem: mapup-os-obuffers-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (mapup-os-obuffers (os-waiting-output-handler-path4 (os))

= deq-ith-buffer (tm-interrupting-output-port (tm-oports (os)), mapup-os-obuffers (os)))

Event: Disable mapup-os-obuffers-os-waiting-output-handler-path4.

Theorem: mapup-os-mbuffers-os-waiting-output-handler-path4 good-os (os) → (mapup-os-mbuffers (os-waiting-output-handler-path4 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-waiting-output-handler-path4.

Theorem: tm-rwstate-os-waiting-output-handler-path4 tm-rwstate (os-waiting-output-handler-path4 (os)) = '1

Event: Disable tm-rwstate-os-waiting-output-handler-path4.

Theorem: tm-clock-os-waiting-output-handler-path4 tm-clock (os-waiting-output-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-waiting-output-handler-path4.

Theorem: tm-iports-os-waiting-output-handler-path4 tm-iports (os-waiting-output-handler-path4 (os)) = tm-iports (os)

Event: Disable tm-iports-os-waiting-output-handler-path4.

Theorem: tm-oports-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-oports (os-waiting-output-handler-path4 (os))

= tm-start-output (qfirst (getnth (tm-interrupting-output-port (tm-oports (os)),

mapup-os-obuffers (os))),

tm-interrupting-output-port (tm-oports (os)), tm-oports (os)))

Event: Disable tm-oports-os-waiting-output-handler-path4.

Theorem: correctness-of-os-waiting-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (tm-waiting (os)

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (mapup-os (os-waiting-output-handler-path4 (os))

= ak-waiting-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-output-handler-path4.

Theorem: correctness-of-os-waiting-output-handler (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ tm-waiting (os))) → (mapup-os (os-waiting-output-handler (os))

= ak-waiting-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-waiting-output-handler.

Theorem: mapup-base-os-running-output-handler-path1 good-os (os) → (mapup-base (taskid, os-running-output-handler-path1 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-output-handler-path1.

Theorem: mapup-limit-os-running-output-handler-path1 good-os (os) → (mapup-limit (taskid, os-running-output-handler-path1 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-output-handler-path1.

Theorem: getseg-tm-memory-os-running-output-handler-path1 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-output-handler-path1 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-output-handler-path1.

Theorem: tm-cpu-os-running-output-handler-path1-crock tm-cpu (os-running-output-handler-path1 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-output-handler-path1-crock.

Theorem: tm-cpu-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (tm-cpu (os-running-output-handler-path1 (os))

= getnth (os-current-taskid (os-running-output-handler-path1 (os)),

table ('9, os-task-table (os-running-output-handler-path1 (os)))))

Event: Disable tm-cpu-os-running-output-handler-path1.

Theorem: mapup-cpu-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)),

os-status-table (os))

= '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cpu (taskid, os-running-output-handler-path1 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-output-handler-path1.

Theorem: mapup-regs-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-regs (taskid, os-running-output-handler-path1 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-output-handler-path1.

Theorem: mapup-cc-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cc (taskid, os-running-output-handler-path1 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-output-handler-path1.

Theorem: mapup-error-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-error (taskid, os-running-output-handler-path1 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-output-handler-path1.

Theorem: mapup-svcflag-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcflag (taskid, os-running-output-handler-path1 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-output-handler-path1.

Theorem: mapup-svcid-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcid (taskid, os-running-output-handler-path1 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-output-handler-path1.

Theorem: mapup-task-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-task (taskid, os-running-output-handler-path1 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-output-handler-path1.

Theorem: mapup-tasks-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (taskid ∈ N)))))

→ (mapup-tasks (taskid, os-running-output-handler-path1 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-output-handler-path1.

Theorem: mapup-os-tasks-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (mapup-os-tasks (os-running-output-handler-path1 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-output-handler-path1.

Theorem: mapup-os-ibuffers-os-running-output-handler-path1 good-os (os) → (mapup-os-ibuffers (os-running-output-handler-path1 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-running-output-handler-path1.

Theorem: mapup-os-obuffers-os-running-output-handler-path1 good-os (os) → (mapup-os-obuffers (os-running-output-handler-path1 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-output-handler-path1.

Theorem: mapup-os-mbuffers-os-running-output-handler-path1 good-os (os) → (mapup-os-mbuffers (os-running-output-handler-path1 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-output-handler-path1.

Theorem: mapup-queue-os-readyq-os-running-output-handler-path1 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (mapup-queue (os-readyq (os-running-output-handler-path1 (os)))

= enq (tm-interrupting-output-port (tm-oports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-running-output-handler-path1.

Theorem: mapup-os-status-table-os-running-output-handler-path1 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (table ('2, os-status-table (os-running-output-handler-path1 (os)))

= putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-running-output-handler-path1.

Theorem: tm-rwstate-os-running-output-handler-path1 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-output-handler-path1 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-output-handler-path1.

Theorem: tm-clock-os-running-output-handler-path1 tm-clock (os-running-output-handler-path1 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-output-handler-path1.

Theorem: tm-iports-os-running-output-handler-path1 tm-iports (os-running-output-handler-path1 (os)) = tm-iports (os)

Event: Disable tm-iports-os-running-output-handler-path1.

Theorem: tm-oports-os-running-output-handler-path1 tm-oports (os-running-output-handler-path1 (os)) = tm-clear-output-interrupt (tm-interrupting-output-port (tm-oports (os)),

tm-oports (os))

Event: Disable tm-oports-os-running-output-handler-path1.

Theorem: correctness-of-os-running-output-handler-path1 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (mapup-os (os-running-output-handler-path1 (os))

= ak-running-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-output-handler-path1.

Theorem: mapup-base-os-running-output-handler-path2 good-os (os) → (mapup-base (taskid, os-running-output-handler-path2 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-output-handler-path2.

Theorem: mapup-limit-os-running-output-handler-path2 good-os (os) → (mapup-limit (taskid, os-running-output-handler-path2 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-output-handler-path2.

Theorem: getseg-tm-memory-os-running-output-handler-path2 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-output-handler-path2 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-output-handler-path2.

Theorem: tm-cpu-os-running-output-handler-path2-crock tm-cpu (os-running-output-handler-path2 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-output-handler-path2-crock.

Theorem: tm-cpu-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (tm-cpu (os-running-output-handler-path2 (os))

= getnth (os-current-taskid (os-running-output-handler-path2 (os)),

table ('9, os-task-table (os-running-output-handler-path2 (os)))))

Event: Disable tm-cpu-os-running-output-handler-path2.

Theorem: mapup-cpu-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cpu (taskid, os-running-output-handler-path2 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-output-handler-path2.

Theorem: mapup-regs-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-regs (taskid, os-running-output-handler-path2 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-output-handler-path2.

Theorem: mapup-cc-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-cc (taskid, os-running-output-handler-path2 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-output-handler-path2.

Theorem: mapup-error-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-error (taskid, os-running-output-handler-path2 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-output-handler-path2.

Theorem: mapup-svcflag-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcflag (taskid, os-running-output-handler-path2 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-output-handler-path2.

Theorem: mapup-svcid-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-svcid (taskid, os-running-output-handler-path2 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-output-handler-path2.

Theorem: mapup-task-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ ((taskid ∈ N) ∧ (taskid < '16))))))

→ (mapup-task (taskid, os-running-output-handler-path2 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-output-handler-path2.

Theorem: mapup-tasks-os-running-output-handler-path2 (good-os (os)

∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (taskid ∈ N)))))

→ (mapup-tasks (taskid, os-running-output-handler-path2 (os)) = mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-output-handler-path2.

Theorem: mapup-os-tasks-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (mapup-os-tasks (os-running-output-handler-path2 (os)) = mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-output-handler-path2.

Theorem: mapup-os-ibuffers-os-running-output-handler-path2 good-os (os) → (mapup-os-ibuffers (os-running-output-handler-path2 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-running-output-handler-path2.

Theorem: mapup-os-obuffers-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (mapup-os-obuffers (os-running-output-handler-path2 (os))

= deq-ith-buffer (tm-interrupting-output-port (tm-oports (os)), mapup-os-obuffers (os)))

Event: Disable mapup-os-obuffers-os-running-output-handler-path2.

Theorem: mapup-os-mbuffers-os-running-output-handler-path2 good-os (os) → (mapup-os-mbuffers (os-running-output-handler-path2 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-output-handler-path2.

Theorem: mapup-queue-os-readyq-os-running-output-handler-path2 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ (getnth ('2 ∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

= '4))))

→ (mapup-queue (os-readyq (os-running-output-handler-path2 (os)))

= enq (tm-interrupting-output-port (tm-oports (os)), mapup-queue (os-readyq (os))))

Event: Disable mapup-queue-os-readyq-os-running-output-handler-path2.

Theorem: mapup-os-status-table-os-running-output-handler-path2 (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (table ('2, os-status-table (os-running-output-handler-path2 (os)))

= putnth ('(0 0), tm-interrupting-output-port (tm-oports (os)), table ('2, os-status-table (os))))

Event: Disable mapup-os-status-table-os-running-output-handler-path2.

Theorem: tm-rwstate-os-running-output-handler-path2 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-output-handler-path2 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-output-handler-path2.

Theorem: tm-clock-os-running-output-handler-path2 tm-clock (os-running-output-handler-path2 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-output-handler-path2.

Theorem: tm-iports-os-running-output-handler-path2 tm-iports (os-running-output-handler-path2 (os)) = tm-iports (os)

Event: Disable tm-iports-os-running-output-handler-path2.

Theorem: tm-oports-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-oports (os-running-output-handler-path2 (os))

= tm-start-output (qfirst (getnth (tm-interrupting-output-port (tm-oports (os)),

mapup-os-obuffers (os))),

tm-interrupting-output-port (tm-oports (os)), tm-oports (os)))

Event: Disable tm-oports-os-running-output-handler-path2.

Theorem: correctness-of-os-running-output-handler-path2 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              = '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (mapup-os (os-running-output-handler-path2 (os))

= ak-running-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-output-handler-path2.

Theorem: mapup-base-os-running-output-handler-path3 good-os (os) → (mapup-base (taskid, os-running-output-handler-path3 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-output-handler-path3.

Theorem: mapup-limit-os-running-output-handler-path3 good-os (os) → (mapup-limit (taskid, os-running-output-handler-path3 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-output-handler-path3.

Theorem: getseg-tm-memory-os-running-output-handler-path3 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-output-handler-path3 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-output-handler-path3.

Theorem: tm-cpu-os-running-output-handler-path3-crock tm-cpu (os-running-output-handler-path3 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-output-handler-path3-crock.

Theorem: tm-cpu-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-output-interruptp (tm-oports (os)))) → (tm-cpu (os-running-output-handler-path3 (os))

= getnth (os-current-taskid (os-running-output-handler-path3 (os)),

table ('9, os-task-table (os-running-output-handler-path3 (os)))))

Event: Disable tm-cpu-os-running-output-handler-path3.

Theorem: mapup-cpu-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-running-output-handler-path3 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-output-handler-path3.

Theorem: mapup-regs-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-running-output-handler-path3 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-output-handler-path3.

Theorem: mapup-cc-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-running-output-handler-path3 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-output-handler-path3.

Theorem: mapup-error-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-running-output-handler-path3 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-output-handler-path3.

Theorem: mapup-svcflag-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-running-output-handler-path3 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-output-handler-path3.

Theorem: mapup-svcid-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-running-output-handler-path3 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-output-handler-path3.

Theorem: mapup-task-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-running-output-handler-path3 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-output-handler-path3.

Theorem: mapup-tasks-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-running-output-handler-path3 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-output-handler-path3.

Theorem: mapup-os-tasks-os-running-output-handler-path3 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-output-interruptp (tm-oports (os)))) → (mapup-os-tasks (os-running-output-handler-path3 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-output-handler-path3.

Theorem: mapup-os-ibuffers-os-running-output-handler-path3 good-os (os) → (mapup-os-ibuffers (os-running-output-handler-path3 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-running-output-handler-path3.

Theorem: mapup-os-obuffers-os-running-output-handler-path3 good-os (os) → (mapup-os-obuffers (os-running-output-handler-path3 (os))

= mapup-os-obuffers (os))

Event: Disable mapup-os-obuffers-os-running-output-handler-path3.

Theorem: mapup-os-mbuffers-os-running-output-handler-path3 good-os (os) → (mapup-os-mbuffers (os-running-output-handler-path3 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-output-handler-path3.

Theorem: tm-rwstate-os-running-output-handler-path3 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-output-handler-path3 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-output-handler-path3.

Theorem: tm-clock-os-running-output-handler-path3 tm-clock (os-running-output-handler-path3 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-output-handler-path3.

Theorem: tm-iports-os-running-output-handler-path3 tm-iports (os-running-output-handler-path3 (os)) = tm-iports (os)

Event: Disable tm-iports-os-running-output-handler-path3.

Theorem: tm-oports-os-running-output-handler-path3 tm-oports (os-running-output-handler-path3 (os)) = tm-clear-output-interrupt (tm-interrupting-output-port (tm-oports (os)),

tm-oports (os))

Event: Disable tm-oports-os-running-output-handler-path3.

Theorem: correctness-of-os-running-output-handler-path3 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os))))))

→ (mapup-os (os-running-output-handler-path3 (os))

= ak-running-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-output-handler-path3.

Theorem: mapup-base-os-running-output-handler-path4 good-os (os) → (mapup-base (taskid, os-running-output-handler-path4 (os))

= mapup-base (taskid, os))

Event: Disable mapup-base-os-running-output-handler-path4.

Theorem: mapup-limit-os-running-output-handler-path4 good-os (os) → (mapup-limit (taskid, os-running-output-handler-path4 (os))

= mapup-limit (taskid, os))

Event: Disable mapup-limit-os-running-output-handler-path4.

Theorem: getseg-tm-memory-os-running-output-handler-path4 (good-os (os) ∧ (taskid < '16)) → (getseg (mapup-base (taskid, os),

mapup-limit (taskid, os),

tm-memory (os-running-output-handler-path4 (os))) = getseg (mapup-base (taskid, os),

mapup-limit (taskid, os), tm-memory (os)))

Event: Disable getseg-tm-memory-os-running-output-handler-path4.

Theorem: tm-cpu-os-running-output-handler-path4-crock tm-cpu (os-running-output-handler-path4 (os)) = tm-cpu (os)

Event: Disable tm-cpu-os-running-output-handler-path4-crock.

Theorem: tm-cpu-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-output-interruptp (tm-oports (os)))) → (tm-cpu (os-running-output-handler-path4 (os))

= getnth (os-current-taskid (os-running-output-handler-path4 (os)),

table ('9, os-task-table (os-running-output-handler-path4 (os)))))

Event: Disable tm-cpu-os-running-output-handler-path4.

Theorem: mapup-cpu-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cpu (taskid, os-running-output-handler-path4 (os)) = mapup-cpu (taskid, os))

Event: Disable mapup-cpu-os-running-output-handler-path4.

Theorem: mapup-regs-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-regs (taskid, os-running-output-handler-path4 (os)) = mapup-regs (taskid, os))

Event: Disable mapup-regs-os-running-output-handler-path4.

Theorem: mapup-cc-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-cc (taskid, os-running-output-handler-path4 (os)) = mapup-cc (taskid, os))

Event: Disable mapup-cc-os-running-output-handler-path4.

Theorem: mapup-error-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-error (taskid, os-running-output-handler-path4 (os)) = mapup-error (taskid, os))

Event: Disable mapup-error-os-running-output-handler-path4.

Theorem: mapup-svcflag-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcflag (taskid, os-running-output-handler-path4 (os)) = mapup-svcflag (taskid, os))

Event: Disable mapup-svcflag-os-running-output-handler-path4.

Theorem: mapup-svcid-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-svcid (taskid, os-running-output-handler-path4 (os)) = mapup-svcid (taskid, os))

Event: Disable mapup-svcid-os-running-output-handler-path4.

Theorem: mapup-task-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ ((taskid ∈ N) ∧ (taskid < '16)))))

→ (mapup-task (taskid, os-running-output-handler-path4 (os)) = mapup-task (taskid, os))

Event: Disable mapup-task-os-running-output-handler-path4.

Theorem: mapup-tasks-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os))

∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (taskid ∈ N)))) → (mapup-tasks (taskid, os-running-output-handler-path4 (os))

= mapup-tasks (taskid, os))

Event: Disable mapup-tasks-os-running-output-handler-path4.

Theorem: mapup-os-tasks-os-running-output-handler-path4 (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ tm-some-output-interruptp (tm-oports (os)))) → (mapup-os-tasks (os-running-output-handler-path4 (os))

= mapup-os-tasks (os))

Event: Disable mapup-os-tasks-os-running-output-handler-path4.

Theorem: mapup-os-ibuffers-os-running-output-handler-path4 good-os (os) → (mapup-os-ibuffers (os-running-output-handler-path4 (os))

= mapup-os-ibuffers (os))

Event: Disable mapup-os-ibuffers-os-running-output-handler-path4.

Theorem: mapup-os-obuffers-os-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (mapup-os-obuffers (os-running-output-handler-path4 (os))

= deq-ith-buffer (tm-interrupting-output-port (tm-oports (os)), mapup-os-obuffers (os)))

Event: Disable mapup-os-obuffers-os-running-output-handler-path4.

Theorem: mapup-os-mbuffers-os-running-output-handler-path4 good-os (os) → (mapup-os-mbuffers (os-running-output-handler-path4 (os))

= mapup-os-mbuffers (os))

Event: Disable mapup-os-mbuffers-os-running-output-handler-path4.

Theorem: tm-rwstate-os-running-output-handler-path4 (good-tm (os) ∧ (¬ tm-waiting (os))) → (tm-rwstate (os-running-output-handler-path4 (os)) = tm-rwstate (os))

Event: Disable tm-rwstate-os-running-output-handler-path4.

Theorem: tm-clock-os-running-output-handler-path4 tm-clock (os-running-output-handler-path4 (os)) = tm-clock (os)

Event: Disable tm-clock-os-running-output-handler-path4.

Theorem: tm-iports-os-running-output-handler-path4 tm-iports (os-running-output-handler-path4 (os)) = tm-iports (os)

Event: Disable tm-iports-os-running-output-handler-path4.

Theorem: tm-oports-os-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))

→ (tm-oports (os-running-output-handler-path4 (os))

= tm-start-output (qfirst (getnth (tm-interrupting-output-port (tm-oports (os)),

mapup-os-obuffers (os))),

tm-interrupting-output-port (tm-oports (os)), tm-oports (os)))

Event: Disable tm-oports-os-running-output-handler-path4.

Theorem: correctness-of-os-running-output-handler-path4 (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os))

∧ ((¬ tm-waiting (os)) ∧ ((getnth ('2

∗ tm-interrupting-output-port (tm-oports (os)), os-status-table (os))

              ≠ '4)

∧ (¬ array-qemptyp (os-current-obuffer (tm-interrupting-output-port (tm-oports (os)), os)))))))

→ (mapup-os (os-running-output-handler-path4 (os))

= ak-running-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-output-handler-path4.

Theorem: correctness-of-os-running-output-handler (good-os (os) ∧ (tm-some-output-interruptp (tm-oports (os)) ∧ (¬ tm-waiting (os)))) → (mapup-os (os-running-output-handler (os))

= ak-running-output-interrupt-handler (tm-interrupting-output-port (tm-oports (os)), mapup-os (os)))

Event: Disable correctness-of-os-running-output-handler.

Theorem: tm-svcid-mapup-task (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-svcid (mapup-task (qfirst (mapup-queue (os-readyq (os))), os))

= tm-svcid (os))

Event: Disable tm-svcid-mapup-task.

Theorem: getnth-mapup-tasks-corollary ((i < '16) ∧ (i ∈ N)) → (getnth (i, mapup-tasks ('0, os)) = mapup-task (i, os))

Event: Disable getnth-mapup-tasks-corollary.

Theorem: tm-svcid-mapup-os-tasks (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-svcid (getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os)))

= tm-svcid (os))

Event: Disable tm-svcid-mapup-os-tasks.

Theorem: tm-svcid-getnth-ak-pstates (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-svcid (getnth (qfirst (ak-readyq (mapup-os (os))),

ak-pstates (mapup-os (os))))

= tm-svcid (os))

Event: Disable tm-svcid-getnth-ak-pstates.

Theorem: tm-regs-mapup-task (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-regs (mapup-task (qfirst (mapup-queue (os-readyq (os))), os))

= tm-regs (os))

Event: Disable tm-regs-mapup-task.

Theorem: tm-regs-mapup-os-tasks (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-regs (getnth (qfirst (mapup-queue (os-readyq (os))), mapup-os-tasks (os)))

= tm-regs (os))

Event: Disable tm-regs-mapup-os-tasks.

Theorem: tm-regs-getnth-ak-pstates (good-os (os) ∧ (¬ tm-waiting (os))) → ((tm-r2 (getnth (qfirst (ak-readyq (mapup-os (os))),

ak-pstates (mapup-os (os))))

= tm-r2 (os))

∧ (tm-r3 (getnth (qfirst (ak-readyq (mapup-os (os))),

ak-pstates (mapup-os (os))))

= tm-r3 (os)))

Event: Disable tm-regs-getnth-ak-pstates.

Theorem: ak-readyq-mapup-os good-os (os) → (mapup-queue (os-readyq (os)) = ak-readyq (mapup-os (os)))

Event: Disable ak-readyq-mapup-os.

Theorem: correctness-of-svc-handler (good-os (os) ∧ ((¬ tm-waiting (os)) ∧ (¬ tm-errorp (os)))) → (mapup-os (os-svc-handler (os)) = ak-svc-handler (mapup-os (os)))

Event: Disable correctness-of-svc-handler.

Theorem: ak-waiting-mapup-os good-os (os) → (ak-waiting (mapup-os (os)) = tm-waiting (os))

Event: Disable ak-waiting-mapup-os.

Theorem: ak-iports-mapup-os good-os (os) → (ak-iports (mapup-os (os)) = tm-iports (os))

Event: Disable ak-iports-mapup-os.

Theorem: correctness-of-input-interrupt-handler (good-os (os) ∧ tm-some-input-interruptp (tm-iports (os))) → (mapup-os (os-input-interrupt-handler (os))

= ak-input-interrupt-handler (tm-interrupting-input-port (ak-iports (mapup-os (os))), mapup-os (os)))

Event: Disable correctness-of-input-interrupt-handler.

Theorem: ak-oports-mapup-os good-os (os) → (ak-oports (mapup-os (os)) = tm-oports (os))

Event: Disable ak-oports-mapup-os.

Theorem: correctness-of-output-interrupt-handler (good-os (os) ∧ tm-some-output-interruptp (tm-oports (os))) → (mapup-os (os-output-interrupt-handler (os))

= ak-output-interrupt-handler (tm-interrupting-output-port (ak-oports (mapup-os (os))), mapup-os (os)))

Event: Disable correctness-of-output-interrupt-handler.

Theorem: tm-error-mapup-task (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-error (mapup-task (qfirst (mapup-queue (os-readyq (os))), os))

= tm-error (os))

Event: Disable tm-error-mapup-task.

Theorem: tm-error-mapup-os-tasks (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-error (getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os)))

= tm-error (os))

Event: Disable tm-error-mapup-os-tasks.

Theorem: tm-svcflag-mapup-task (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-svcflag (mapup-task (qfirst (mapup-queue (os-readyq (os))), os))

= tm-svcflag (os))

Event: Disable tm-svcflag-mapup-task.

Theorem: tm-svcflag-mapup-os-tasks (good-os (os) ∧ (¬ tm-waiting (os))) → (tm-svcflag (getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os)))

= tm-svcflag (os))

Event: Disable tm-svcflag-mapup-os-tasks.

Theorem: not-tm-in-supervisor-mode-mapup-task ¬ tm-in-supervisor-mode (mapup-task (taskid, os))

Event: Disable not-tm-in-supervisor-mode-mapup-task.

Theorem: not-tm-in-supervisor-mode-getnth-mapup-os-tasks (good-os (os) ∧ (¬ tm-waiting (os))) → (¬ tm-in-supervisor-mode (getnth (qfirst (mapup-queue (os-readyq (os))),

mapup-os-tasks (os))))

Event: Disable not-tm-in-supervisor-mode-getnth-mapup-os-tasks.

Theorem: ak-input-interruptp-mapup-os good-os (os) → (ak-input-interruptp (mapup-os (os)) = tm-input-interruptp (os))

Event: Disable ak-input-interruptp-mapup-os.

Theorem: ak-output-interruptp-mapup-os good-os (os) → (ak-output-interruptp (mapup-os (os)) = tm-output-interruptp (os))

Event: Disable ak-output-interruptp-mapup-os.

Theorem: ak-errorp-mapup-os (good-os (os) ∧ (¬ tm-waiting (os))) → (ak-errorp (mapup-os (os)) = tm-errorp (os))

Event: Disable ak-errorp-mapup-os.

Theorem: ak-svc-interruptp-mapup-os (good-os (os) ∧ (¬ tm-waiting (os))) → (ak-svc-interruptp (mapup-os (os)) = tm-svc-interruptp (os))

Event: Disable ak-svc-interruptp-mapup-os.

Theorem: ak-clock-interruptp-mapup-os good-os (os) → (ak-clock-interruptp (mapup-os (os)) = tm-clock-interruptp (os))

Event: Disable ak-clock-interruptp-mapup-os.

Theorem: os-step-implements-ak-step good-os (os) → (mapup-os (os-step (os)) = ak-step (mapup-os (os)))

Event: Disable os-step-implements-ak-step.

Theorem: mapup-cpu-tm-post-interrupt mapup-cpu (taskid, tm-post-interrupt (interrupt, os)) = mapup-cpu (taskid, os)

Event: Disable mapup-cpu-tm-post-interrupt.

Theorem: mapup-task-tm-post-interrupt mapup-task (taskid, tm-post-interrupt (interrupt, os)) = mapup-task (taskid, os)

Event: Disable mapup-task-tm-post-interrupt.

Theorem: mapup-tasks-tm-post-interrupt mapup-tasks (taskid, tm-post-interrupt (interrupt, os)) = mapup-tasks (taskid, os)

Event: Disable mapup-tasks-tm-post-interrupt.

Theorem: mapup-os-tm-post-interrupt mapup-os (tm-post-interrupt (interrupt, os)) = ak-post-interrupt (interrupt, mapup-os (os))

Event: Disable mapup-os-tm-post-interrupt.

Definition: bak-processor (ak, oracle) = if listp (oracle)

then ak-step (ak-post-interrupt (car (oracle),

bak-processor (ak, cdr (oracle))))

else ak endif

Theorem: bak-implements-ak bak-processor (ak, oracle) = ak-processor (ak, reverse (oracle))

Event: Disable bak-implements-ak.

Theorem: bos-implements-bak good-os (os) → (mapup-os (bos-processor (os, oracle))

= bak-processor (mapup-os (os), oracle))

Event: Disable bos-implements-bak.

Theorem: os-implements-ak (good-os (os) ∧ plistp (oracle)) → (mapup-os (os-processor (os, oracle))

= ak-processor (mapup-os (os), oracle))

Event: Disable os-implements-ak.

Theorem: correctness-of-operating-system (good-os (os) ∧ plistp (oracle)) → (mapup-os (tm-processor (os, os-oracle (os, oracle)))

= ak-processor (mapup-os (os), oracle))

Event: Disable correctness-of-operating-system.

Definition: project-ith-task (i, os) = project (i, mapup-os (os))

Theorem: os-implements-parallel-tasks (good-os (os) ∧ (plistp (oracle)

∧ finite-numberp (i, length (ak-pstates (mapup-os (os)))))) → (project-ith-task (i, tm-processor (os, os-oracle (os, oracle)))

= task-processor (project-ith-task (i, os), i, control-oracle (i, mapup-os (os), oracle)))

Index

a-finite-number-is-a-number, 49 a-finite-number-is-lessp-than-it

s-lub, 49 a-finite-number-list-is-a-numbe

r-list, 50 a-finite-number-table-is-a-table, 61 access-ak-error-handler, 314 access-ak-input-interrupt-handle

r, 313 access-ak-output-interrupt-hand

ler, 313 access-ak-post-interrupt, 313 access-current-ibuffer, 422 access-current-ibuffer-qhead, 422 access-current-mbuffer, 413 access-current-mbuffer-qhead, 414 access-current-obuffer, 429 access-current-obuffer-qhead, 431 access-current-os-mbuffer-field

s, 410

s-for-receive, 412 access-os-memory, 736 access-os-segment-table, 404 access-os-status-table, 406 access-os-status-table-crock, 405 address-space-good-memory-tm-st

ore, 209 address-space-good-regs-tm-store, 209 address-space-memlength, 205 ak, 279, 282–290, 372 ak-block-input, 285, 286, 305, 311 ak-block-output, 285, 304, 311 ak-block-receive, 284, 304, 310 ak-block-send, 283, 284, 303, 310 ak-channels, 312, 313, 315, 316 ak-clear-input-interrupt, 280, 287, 288 ak-clear-output-interrupt, 280, 288,

289 ak-clock, 282–289, 297 ak-clock-interrupt-handler, 282, 289,

303, 310, 313, 892 ak-clock-interruptp, 289, 313, 1103 ak-clock-interruptp-mapup-os, 1103 ak-communicationp, 280 ak-destid, 280, 286, 306, 315 ak-dispatcher, 282–285, 287, 288 ak-error-handler, 282, 289, 302, 310, 313, 314, 896, 902

ak-error-status, 281

ak-errorp, 280, 289, 313, 1103 ak-errorp-mapup-os, 1103 ak-execute-input, 286, 305, 311, 315, 316, 958, 964, 971 ak-execute-input-from-buffer, 286, 305,

311 ak-execute-input-implements-tas k-execute-input, 315

ak-execute-output, 285, 286, 305, 311, 316, 975, 981, 987, 993

ak-execute-output-implements-ta sk-execute-output, 316

ak-execute-output-to-buffer, 285, 305,

311 ak-execute-receive, 284, 286, 304, 311, 315, 931, 938, 946, 954

ak-execute-receive-from-buffer, 284,

304, 311 ak-execute-receive-implements-t ask-execute-receive, 315 ak-execute-send, 283, 286, 303, 310,

315, 906, 913, 920, 927 ak-execute-send-implements-task -execute-send, 315

ak-execute-send-to-buffer, 283, 284,

303, 310 ak-fetch-execute, 280, 286 ak-ibuffers, 282–289, 294, 305, 312–

314 ak-idevid, 280 ak-implements-active-task-step, 317 ak-implements-non-active-task-step,

314 ak-implements-parallel-tasks, 317 ak-input-interrupt-handler, 288, 289,

308, 312, 313, 1101 ak-input-interruptp, 281, 289, 308,

312, 1103 ak-input-interruptp-mapup-os, 1103 ak-input-status, 281 ak-interrupting-input-port, 281, 289,

308 ak-interrupting-output-port, 281, 289,

309 ak-iports, 281–289, 297, 307, 308,

312, 1101 ak-iports-mapup-os, 1101 ak-mbuffers, 282–289, 295, 303, 304,

312–314 ak-message, 280, 286, 306, 315, 316 ak-obuffers, 282–289, 294, 295, 304,

305, 312–314 ak-odevid, 280 ak-oport-idlep, 280, 285 ak-oports, 281–290, 297, 309, 312,

1101 ak-oports-mapup-os, 1101 ak-output-interrupt-handler, 289, 309,

312, 313, 1101 ak-output-interruptp, 281, 289, 309,

312, 1103 ak-output-interruptp-mapup-os, 1103 ak-output-status, 281 ak-post-interrupt, 289, 290, 309, 310,

313, 314, 317, 1104 ak-post-output-interrupt, 280, 285 ak-private-step, 286, 289, 306, 312–

314, 316, 392 ak-private-step-implements-task

-fetch-execute, 316 ak-private-step-non-interference, 314 ak-processor, 290, 310, 317, 1104,

1105 ak-pstates, 279, 280, 282–289, 294,

310–317, 1100, 1105 ak-pstates-ak-block-input, 311 ak-pstates-ak-block-output, 311 ak-pstates-ak-block-receive, 310 ak-pstates-ak-block-send, 310 ak-pstates-ak-clock-interrupt-h

andler, 310 ak-pstates-ak-error-handler, 310 ak-pstates-ak-input-interrupt-h

andler, 312 ak-pstates-ak-output-interrupt-

handler, 312 ak-ready-set, 292, 298, 302, 377 ak-ready-set-mapup-os, 377 ak-ready-status, 281 ak-ready-statusp, 281 ak-readyq, 279, 282–289, 296, 298,

302, 1100, 1101 ak-readyq-mapup-os, 1101 ak-receive-instructionp, 279, 286 ak-receive-status, 281 ak-run-state, 282 ak-running-input-interrupt-hand

ler, 287, 288, 307, 1031, 1037, 1043, 1047, 1052, 1057

ak-running-output-interrupt-han

dler, 288, 289, 308, 309, 1084, 1090, 1094, 1099

ak-rwstate, 282–289, 296 ak-send-instructionp, 279, 286 ak-send-status, 281 ak-shell, 279 ak-shellp, 293 ak-shellp-ak, 293 ak-srcid, 280, 286, 306, 315 ak-start-output, 281, 288, 289 ak-status, 281–289, 292, 296, 302–

304, 306 ak-status-flag-field, 281 ak-status-length, 281 ak-status-lub, 281 ak-status-taskid-field, 281 ak-step, 289, 290, 309, 312–314, 317,

1103, 1104 ak-store-message, 280, 284, 286 ak-svc-handler, 286, 289, 306, 312–

314, 316, 1101 ak-svc-handler-implements-task-

communication-step, 316 ak-svc-handler-non-interference, 314 ak-svc-interruptp, 280, 289, 313, 1103 ak-svc-interruptp-mapup-os, 1103 ak-taskid, 279, 280, 282, 283, 286,

295, 303–305, 313–316 ak-taskidlub, 279 ak-time-slice, 279 ak-tyi-instructionp, 279 ak-tyo-instructionp, 279, 286 ak-update-control, 279, 283–286 ak-update-ibuffer, 287 ak-wait-state, 282 ak-waiting, 282, 288, 289, 295, 298,

302–309, 313–316, 1101 ak-waiting-iff-qemptyp-ak-readyq, 298 ak-waiting-input-interrupt-hand

ler, 287, 288, 307, 1000, 1007, 1014, 1017, 1021, 1025

ak-waiting-mapup-os, 1101 ak-waiting-output-interrupt-han

dler, 288, 289, 308, 1064, 1071,

1074, 1078 ak-waiting-to-inputp, 282, 287, 302,

306, 307, 1000, 1017 ak-waiting-to-inputp-implies-not

-status-flag-readyp, 306 ak-waiting-to-inputp-implies-re

adyq-not-full, 302 ak-waiting-to-inputp-mapup-os, 999 ak-waiting-to-outputp, 282, 288, 302,

306, 308, 1063, 1074 ak-waiting-to-outputp-implies-n

ot-status-flag-readyp, 306 ak-waiting-to-outputp-implies-re

adyq-not-full, 302 ak-waiting-to-outputp-mapup-os, 1063 ak-waiting-to-receivep, 281, 283, 302,

303, 920, 926 ak-waiting-to-receivep-implies-

not-status-flag-readyp, 303 readyq-not-full, 302

ak-waiting-to-receivep-mapup-os, 919 ak-waiting-to-sendp, 281, 284, 302, 304, 946, 953 ak-waiting-to-sendp-implies-not -status-flag-readyp, 304 ak-waiting-to-sendp-implies-rea

dyq-not-full, 302 ak-waiting-to-sendp-mapup-os, 945 alu-carry, 85, 98 alu-result, 85, 86 alu-value, 85–90, 98, 103–106 append-cdr, 33 append-crock, 33 append-firstn-nthcdr, 54 append-fixlength, 33 append-n-times, 318, 319 append-nil-on-right, 33 append-non-list-left, 33 append-non-list-left-corollary, 33 array-deq, 70–72, 81, 82, 354, 366,

368, 392, 415, 417, 423, 426, 431, 444, 454, 455, 457, 458, 460, 470, 472, 488, 490, 497, 505, 507, 523, 524, 532, 541, 543, 549, 550, 552, 562, 564, 572, 573, 577, 740, 742–747, 749–754, 763–766, 768–770, 779–785, 789, 791, 792, 794, 795, 896, 898–902, 906, 908– 911, 913, 931, 933–936, 938, 958, 960–964, 975, 977–981

array-enq, 70–72, 76, 80, 84, 354, 366, 368, 392, 415, 417, 424– 426, 431, 444, 756, 757, 772, 773, 802, 804, 806, 809, 810, 813, 815, 826, 827, 829, 832, 834, 837, 838, 851, 852, 854, 856, 858, 865, 867, 868, 871, 873

array-nonlast, 73, 74, 76, 77, 83 array-qarray-array-deq, 72 array-qarray-array-enq, 71 array-qarray-array-nonlast, 74 array-qarray-array-qreplace, 77 array-qcurrlength-array-deq, 72 array-qcurrlength-array-enq, 71 array-qcurrlength-array-nonlast, 74 array-qcurrlength-array-qreplace, 77 array-qcurrlength-in-a-full-que

ue, 72 array-qcurrlength-in-a-non-empt

y-queue, 73 array-qcurrlength-in-a-non-full

-queue, 73 array-qcurrlength-in-an-empty-q

ueue, 73 array-qemptyp, 70, 72, 73, 76–79,

81–84, 354, 364, 366, 368, 370, 392, 393, 417, 418, 426, 427, 454, 455, 457, 458, 460, 470, 472, 488, 490, 497, 503, 505, 507, 510, 523, 524, 526, 529, 531, 532, 539, 541, 543, 546, 549, 550, 552, 562, 564, 572, 573, 577, 680, 682, 691, 694, 699, 701–704, 711, 714, 723, 725, 730, 732, 734–736, 738, 740, 743, 744, 747, 750, 751, 754, 763, 766, 770, 772– 775, 778, 779, 782, 785, 787, 789, 792, 795, 851, 855, 857, 859, 862, 864–866, 869, 870, 872, 874, 877, 879, 881, 896, 898–902, 906, 909–911, 913, 931, 934–936, 938, 944, 946, 952, 954, 958, 960–964, 969, 971, 975, 977–981, 1064, 1069– 1071, 1074, 1077, 1078, 1084, 1088, 1090, 1094, 1098, 1099

array-qemptyp-implies-not-array

-qfullp, 84 array-qemtpyp-array-deq-when-de

lta-is-1, 81 lta-is-1-alternative, 81

array-qfirst, 70, 82, 84, 354, 357, 365, 366, 368, 379, 380, 392, 403, 407, 408, 411, 413, 415, 417, 426, 427, 432–436, 444, 568, 570, 575–577, 739, 742, 743, 745, 746, 749, 750, 753, 765, 768, 769, 781, 784, 785, 791, 794–796, 799, 802, 889, 895, 898, 899, 902, 905, 908, 909, 912, 914–918, 921–925, 930, 933, 934, 937, 939–944, 947–952, 957, 960, 961, 964– 969, 974, 977, 981–985, 987– 991, 993

array-qfirst-array-enq, 84 array-qfirst-array-enq1, 84 array-qfirst-finite-number-queue, 354

-corollary, 366 -corollary-for-ibuffers, 417 -corollary-for-mbuffers, 368 -corollary-for-obuffers, 426

array-qfirst-os-readyq-os-svc-re

ceive-handler-path3, 939 array-qfirst-os-readyq-os-svc-se

nd-handler-path3, 914 array-qfullp, 70–73, 77, 78, 80–82,

84, 354, 366, 368–370, 415, 417, 426, 468, 475, 488, 490, 492, 494, 496, 497, 560, 566, 572, 573, 575–577, 585, 588, 591, 600, 602, 603, 608, 611, 613, 621, 623–625, 633, 636, 639, 647, 648, 650, 655, 658, 661, 668, 670–672, 747, 750, 751, 754, 757–759, 762, 789, 792, 795–797, 799, 802–804, 807, 809, 811, 812, 814, 816, 818, 819, 821, 822, 824–826, 828, 830, 832, 835, 837, 839– 841, 843, 845–847, 849, 850, 906, 913–918, 920, 925, 927, 939–943, 975, 981, 986, 987, 991, 993, 998, 1000, 1005, 1007, 1012, 1013, 1016, 1017, 1020, 1021, 1023, 1025, 1029, 1031, 1035, 1037, 1041, 1043, 1046, 1047, 1051, 1052, 1055, 1056

array-qfullp-implies-not-array-qe

mptyp, 78 array-qhead-array-deq, 71 array-qhead-array-enq, 70 array-qhead-array-nonlast, 73 array-qhead-array-qreplace, 77 array-qhead-equals-array-qtail-i

ff-qfull-or-qempty, 78 n-an-empty-queue, 78

array-qindex-relation, 67, 68 array-qmaxlength-array-deq, 72 array-qmaxlength-array-enq, 71 array-qmaxlength-array-nonlast, 74 array-qmaxlength-array-qreplace, 77 array-qmaxlength-must-be-1, 81 array-qreplace, 76–78, 84, 370, 393,

418, 424 array-qtail-array-deq, 72 array-qtail-array-enq, 70 array-qtail-array-nonlast, 74 array-qtail-array-qreplace, 77 array-queue-facts, 78 array-queuep, 68–74, 76–84, 352, 353,

365, 367, 392, 393, 415, 416, 425, 975, 1000

array-queuep-array-deq, 72 array-queuep-array-enq, 71 array-queuep-array-nonlast, 76 array-queuep-array-qreplace, 78 array-queuep-finite-number-queue, 353

-corollary, 365 -corollary-for-ibuffers, 416 -corollary-for-mbuffers, 367 -corollary-for-obuffers, 425

asm-good-arg, 321, 324 asm-good-instruction, 321, 325 asm-instruction-arg1, 320, 324, 325 asm-instruction-arg2, 321, 324, 325 asm-instruction-index1, 320, 324 asm-instruction-index2, 321, 324 asm-instruction-mode1, 320, 324 asm-instruction-mode2, 320, 324 asm-instruction-opcode, 319, 324 asm-opcode-alist, 317 asm-pack-instruction, 324, 325 asm-pack-word1, 324, 325 asm-reverse-opcode-alist, 329 asm-symbolic-opcode, 330 assemble, 329 assemble1, 329 assemble2, 328, 329 assembler, 329 assembly-errorp, 328 associativity-of-append, 33 associativity-of-plus, 2 associativity-of-plus-crock, 414 associativity-of-plus-inverse, 23 associativity-of-times, 4

bak-implements-ak, 1104 bak-processor, 1104 base, 194, 195, 363, 371, 374, 379,

380, 386, 387, 403, 404, 740, 747, 754, 758, 762, 769, 774, 778, 785, 788, 795, 798, 801, 806, 811, 815, 816, 830, 834, 839, 842, 846, 850, 854, 858, 859, 869, 874, 877, 880

base-limit, 194 bos-implements-bak, 1104 bos-implements-os, 886 bos-processor, 886, 1104 boundp, 318–322, 326 btimed-tm-implements-bos, 886 btimed-tm-processor, 885, 886 build-symtab, 327–329

cadr-firstn, 61 canonicalize-plus-terms1, 13 canonicalize-plus-terms2, 13 canonicalize-plus-terms3, 13 car-append, 30 car-append-casesplit, 30 car-getseg, 30 car-nthcdr, 53 car-putnth-zero, 30 car-putseg-zero, 31 cdr-append, 31 cdr-getseg, 31 cdr-is-nil-when-length-is-1, 31 cdr-nthcdr, 53 cl-arithmetic, 12 clean-assembly, 342 commutativity-of-permutation, 26 commutativity-of-plus, 2 commutativity-of-times, 4 commutativity2-of-plus, 2 commutativity2-of-times, 4 contract-array-deq, 392 contract-array-enq, 392 contract-array-enq-instance, 392 contract-array-qfirst, 392 contract-array-qreplace, 393 contract-getnth-from-current-ib

uffer, 422 contract-getnth-from-current-mb

uffer-for-receive, 414 contract-getnth-from-current-ob

uffer, 429 uffer1, 430

contract-list-of-getnths8, 398 contract-os-new-base-expression, 404 contract-os-new-limit-expressio

n, 404 contract-putnth-into-current-ib

uffer, 422 uffer1, 423 uffer2, 423

contract-putnth-into-current-mb uffer, 413 uffer-for-receive1, 414

contract-putnth-into-current-ob uffer, 430 uffer1, 430

contract-putnths-into-status-ta

ble, 405 contract-queues, 393 contract-sequence-of-putnths2, 404 contract-sequence-of-putnths8, 399 control-oracle, 313, 317, 1105 control-oracle-step, 312–314, 317 correctness-of-array-deq, 82 correctness-of-array-deq-case-1, 82 correctness-of-array-deq-case-3, 81 correctness-of-array-enq, 80 correctness-of-array-nonlast, 83 correctness-of-array-nonlast-ca

se1, 83 se2, 83

correctness-of-array-qemptyp, 82 correctness-of-array-qfirst, 82 correctness-of-array-qfullp, 82 correctness-of-array-qfullp-ibu ffers-instance, 1000 correctness-of-array-qfullp-mbu ffers-instance, 415 correctness-of-array-qfullp-obu ffers-instance, 975 correctness-of-array-qreplace, 84 correctness-of-clock-interrupt-

handler, 892 correctness-of-input-interrupt-

handler, 1101 correctness-of-operating-system, 1105 correctness-of-os-error-handler, 902

-path1, 896 -path2, 902

correctness-of-os-running-input -handler, 1057 -handler-path1, 1031 -handler-path2, 1037 -handler-path3, 1043 -handler-path4, 1047 -handler-path5, 1052 -handler-path6, 1056 correctness-of-os-running-output

-handler, 1099

-handler-path1, 1084 -handler-path2, 1090 -handler-path3, 1094 -handler-path4, 1099 correctness-of-os-svc-receive-h

andler, 954

andler-path1, 931 andler-path2, 937 andler-path3, 946 andler-path4, 954 correctness-of-os-svc-send-hand

ler, 927 ler-path1, 906 ler-path2, 912 ler-path3, 920 ler-path4, 927

correctness-of-os-svc-tyi-handle r, 971 r-path1, 958 r-path2, 964 r-path3, 971

correctness-of-os-svc-tyo-handle r, 993 r-path1, 975 r-path2, 981 r-path3, 987 r-path4, 993

correctness-of-os-waiting-input -handler, 1025 -handler-path1, 1000 -handler-path2, 1007 -handler-path3, 1013 -handler-path4, 1017 -handler-path5, 1021 -handler-path6, 1024

correctness-of-os-waiting-output -handler, 1078 -handler-path1, 1063 -handler-path2, 1070 -handler-path3, 1074 -handler-path4, 1078

correctness-of-output-interrupt

-handler, 1101 correctness-of-svc-handler, 1101 correctness-of-tm-fetch-execute, 392 cpu-regs-segment, 130

dc-formp, 318, 319 decr-mod, 63, 64, 73, 74, 77, 82, 83,

85, 87, 370, 393, 421, 423 decr-mod-size, 63 delta, 67, 74, 79, 81 delta-a-a, 67 delta-equals-length-delta-segme

nt, 79 delta-equals-max-iff-a-equals-b, 67 delta-incr-mod-a, 67 delta-incr-mod-b, 67 delta-segment, 78–83 delta-segment-decr-mod-arg2, 83 delta-segment-incr-mod-a, 80 delta-segment-incr-mod-b, 80 delta-segment-putnth-non-interfe

rence, 80 delta-sub1-b-case1, 74 delta-sub1-b-case2, 74 deq, 64–66, 82, 84, 272, 282–286,

300, 892, 895, 901, 905, 912, 930, 937, 957, 963, 974, 980

deq-is-remove, 66 deq-ith-buffer, 272, 275, 288, 969,

1069, 1077, 1088, 1098 deq2, 84, 274, 284, 944, 952 difference-0, 3 difference-1, 10 difference-2, 10 difference-add1-arg1, 14 difference-add1-arg2, 15 difference-add1-cancellation, 7 difference-by-larger-number, 14 difference-cancellation-0, 3 difference-cancellation-1, 3 difference-difference, 15 difference-elim, 5 difference-equals-0, 16 difference-is-zero, 14 difference-plus, 3 difference-plus-cancelation, 6 difference-plus-cancellation2-i

nstance, 15 difference-plus1, 6 difference-plus2, 6 difference-plus3, 7 difference-plus4, 22 difference-sub1-arg1, 15 difference-sub1-arg2, 15 difference-sub1-plus-crock, 63 difference-x-x, 3 difference-zero-arg2, 391 disjoint, 194–200, 386 disjoint-everywhere, 194, 195, 363,

379, 380 disjoint-everywhere-os-segment-t

able, 363 disjoint-getnth, 195 disjoint-segments-induction, 385, 386 distributivity-of-divides, 9 distributivity-of-times-over-di

fference, 16 distributivity-of-times-over-pl

us, 4

us-backwards, 14 divides, 6, 8, 9, 21, 23, 357 divides-implies-times, 10 divides-not-lessp-instance, 357 divides-plus-rewrite, 7 divides-plus-rewrite-commuted, 7 divides-plus-rewrite1, 7 divides-plus-rewrite2, 7 divides-times, 6 divides-times1, 8 divisor-not-lessp, 357 double-number-double-list-inducti

on, 12, 13 double-number-induction, 12

element-of-non-zero-list-is-a-n

umber, 50 element-of-non-zero-list-is-non

-zero, 50 enq, 64–66, 80, 84, 272, 282–284,

287, 288, 302, 892, 919, 945, 999, 1006, 1012, 1030, 1036, 1042, 1062, 1069, 1083, 1089

enq-ith-buffer, 272, 275, 285, 287, 986, 991, 1005, 1012, 1020, 1023, 1035, 1041, 1051, 1055

enq2, 84, 274, 283, 918, 925 equal-difference-0, 3 equal-length-status-sum-of-read

y-and-unready-tasks, 300 equal-lessp, 5 equal-times-0, 4 equality-of-getnth-backchain-co

rollary, 379 equality-of-getnth-backchain-pr

oof, 44 equality-of-getseg-backchain, 47 equality-of-getseg-backchain-ba

se-case, 45 equality-of-getseg-backchain-co

rollary, 379 equality-of-getseg-backchain-in duction-step, 46 duction-step-case1, 45 duction-step-case2, 46 equality-of-getseg-backchain-pr

oof, 47 equivalence-of-clock-interrupt-e

xpressions, 439 equivalence-of-error-interrupt-e

xpressions, 448 equivalence-of-input-interrupt-e

xpressions, 578 equivalence-of-output-interrupt -expressions, 674

equivalence-of-svc-interrupt-exp

ressions, 882 equivalence-of-svc-receive-inte rrupt-expressions, 498 equivalence-of-svc-send-interrupt

-expressions, 461 equivalence-of-svc-tyi-interrupt -expressions, 533 equivalence-of-svc-tyo-interrupt -expressions, 553

euclid, 8

executable-fns, 438 executable-theory, 743 exp, 4, 10, 11, 17 exp-2-never-0, 17 exp-2-never-0-linear, 17 exp-by-0, 11 exp-exp, 11 exp-of-0, 10 exp-of-1, 10 exp-plus, 4 exp-times, 11

find-duplicate-symbol, 328, 329 find-non-finite-number, 328, 329 finite-number-listp, 49–52, 61–63, 65,

66, 79, 120, 121, 128, 129, 133, 135, 206, 209, 276–278, 296, 352, 353, 373, 374, 377

finite-number-listp-address-spa ce-memory, 206 ce-regs, 206

finite-number-listp-ak-readyq, 296 finite-number-listp-append, 51 finite-number-listp-delta-segme

nt, 79 finite-number-listp-deq, 65 finite-number-listp-enq, 65 finite-number-listp-fixlength, 52 finite-number-listp-flatten, 61 finite-number-listp-for-zero-li

st, 52 finite-number-listp-from-smalle

r-lub, 52 finite-number-listp-getseg, 51 finite-number-listp-list, 51 finite-number-listp-mapup-cpu, 373 finite-number-listp-mapup-finite

-number-queue, 377

-number-queue-corollary, 377 finite-number-listp-mapup-queue, 79 finite-number-listp-mapup-regs, 374 finite-number-listp-nil, 61 finite-number-listp-nonlast, 63 finite-number-listp-on-non-list, 129 finite-number-listp-permutation, 51 finite-number-listp-putnth, 51 finite-number-listp-putseg, 51 finite-number-listp-qarray, 353 finite-number-listp-qreplace, 66 finite-number-listp-remove, 51 finite-number-listp-tm-cpu, 129 finite-number-listp-tm-memory, 120 finite-number-listp-tm-regs, 121 finite-number-queue-corollaries, 367

-for-ibuffers, 418 -for-ibuffers1, 418 -for-mbuffers, 406 -for-mbuffers1, 406 -for-obuffers, 427 -for-obuffers1, 427 1, 395

finite-number-queue-listp, 355–357, 364, 368, 369, 372, 375, 757, 773, 787, 798, 805, 809, 814, 818, 821, 824, 828, 832, 837, 841, 845, 849, 857, 864, 872, 879

finite-number-queue-listp-first

n, 356 finite-number-queue-listp-getnt

h, 356

h-corollary, 368 finite-number-queue-listp-getse

g, 357 finite-number-queue-listp-nthcd

r, 356 finite-number-queue-listp-os-ib

uffers, 364

uffers-os-running-input-handler-

path1, 828 uffers-os-running-input-handler-

path2, 832 uffers-os-running-input-handler-

path3, 837 uffers-os-running-input-handler-

path4, 841 uffers-os-running-input-handler-

path5, 845 uffers-os-running-input-handler-

path6, 848 uffers-os-waiting-input-handler-

path1, 804 uffers-os-waiting-input-handler-

path2, 809 uffers-os-waiting-input-handler-

path3, 813 uffers-os-waiting-input-handler-

path4, 818 uffers-os-waiting-input-handler-

path5, 821 uffers-os-waiting-input-handler-

path6, 824 uffers-with-dequeued-character,

787 finite-number-queue-listp-os-mb

uffers, 364 uffers-with-dequeued-message, 772 uffers-with-enqueued-message, 756

finite-number-queue-listp-os-ob uffers, 364 uffers-os-running-output-handler-

path2, 872 uffers-os-running-output-handler-

path4, 879 uffers-os-waiting-output-handler-

path2, 857 uffers-os-waiting-output-handler-

path4, 864 uffers-with-enqueued-character,

797 finite-number-queue-listp-putnt

h, 355 finite-number-queue-qarray-afte

r-deq, 354 r-enq, 354 r-qreplace, 370

finite-number-queue-qcurrlength -size, 353 -size-corollary, 366 -size-corollary-for-ibuffers, 417 -size-corollary-for-mbuffers, 367 -size-corollary-for-obuffers, 426

finite-number-queue-qhead-size, 353 finite-number-queue-qhead-size-

corollary, 365 corollary-for-ibuffers, 416 corollary-for-mbuffers, 367 corollary-for-obuffers, 426

finite-number-queue-qmaxlength-field, 353 finite-number-queue-qmaxlength-v

alue, 354

alue-corollary, 366

alue-corollary-for-ibuffers, 417 alue-corollary-for-mbuffers, 367 alue-corollary-for-obuffers, 426 finite-number-queue-qtail-size, 353 finite-number-queue-qtail-size-

corollary, 365

corollary-for-ibuffers, 416 corollary-for-mbuffers, 367 corollary-for-obuffers, 426 finite-number-queue-tablep, 355–357, 364, 368, 369 finite-number-queue-tablep-coro

llaries, 369 finite-number-queue-tablep-os-m

buffers, 364 finite-number-queue-tablep-putnt

h, 356

h-corollary, 369

h2, 356

h2-corollary, 369 finite-number-queue-tablep-table, 357 finite-number-queuep, 352–356, 363,

365–370, 375, 377, 396, 407, 411, 413, 416–418, 420, 425– 427, 738, 802, 826, 851, 865

finite-number-queuep-array-deq, 354 finite-number-queuep-array-deq-

finite-number-queue-corollary, 366 finite-number-queue-corollary-for-

ibuffers, 417 finite-number-queue-corollary-for-

mbuffers, 368 finite-number-queue-corollary-for-

obuffers, 426 finite-number-queuep-array-enq, 354 finite-number-queuep-array-enq-

finite-number-queue-corollary, 366 finite-number-queue-corollary-for-

ibuffers, 417 finite-number-queue-corollary-for-

mbuffers, 368 finite-number-queue-corollary-for-

obuffers, 426 finite-number-queuep-array-enq-i

nterrupting-input-port, 802 nterrupting-input-port2, 825 nterrupting-output-port, 850 nterrupting-output-port2, 865

finite-number-queuep-array-qrep lace, 370 lace-corollary-for-ibuffers, 418

finite-number-queuep-current-ib

uffer, 418 finite-number-queuep-current-mb

uffer, 407 uffer-for-receive, 407

finite-number-queuep-current-ob

uffer, 427 finite-number-queuep-facts, 355 finite-number-queuep-getnth, 355 finite-number-queuep-getnth2, 356 finite-number-queuep-getnth2-co

rollary, 368 finite-number-queuep-os-clock-ne

w-readyq, 738 finite-number-queuep-os-readyq, 363 finite-number-sub1, 50 finite-number-tablep, 60, 61, 328 finite-number-tablep-append, 61 finite-number-tablep-list, 61 finite-numberp, 49–52, 65, 66, 86–

89, 91, 98, 99, 102, 103, 116–118, 121–127, 129, 131– 133, 136, 137, 139–141, 143, 144, 146–148, 152, 154, 156, 158, 160, 163, 195, 206, 207, 209, 210, 213, 276, 290, 291, 294–297, 302–309, 314, 316, 317, 321, 324, 328, 354, 365, 369, 370, 374, 375, 378, 380, 389, 390, 405, 410, 418, 758, 774, 1105

finite-numberp-add1-address-spa

ce-sp, 213 finite-numberp-add1-tm-sp, 158 finite-numberp-address-space-cc, 206 finite-numberp-address-space-er

ror, 207 finite-numberp-address-space-pc, 207 finite-numberp-address-space-sp, 207 finite-numberp-address-space-sv

cflag, 207 cid, 207

finite-numberp-ak-clock, 297 finite-numberp-ak-destid, 306 finite-numberp-ak-message, 306 finite-numberp-ak-rwstate, 296 finite-numberp-ak-srcid, 306 finite-numberp-ak-taskid, 295 finite-numberp-alu-value-tm-alu

-decr, 86 -decr-mod, 86 -incr, 87 -incr-mod, 87 -mod, 88 -mult, 89 -plus, 89

finite-numberp-from-smaller-lub, 49 finite-numberp-getnth, 50 finite-numberp-getnth-from-curre

nt-mbuffer, 410 nt-mbuffer1, 410

finite-numberp-getnth-os-status

-table, 405 finite-numberp-interrupting-ak-

output-port, 309 finite-numberp-interrupting-ak-i

nput-port, 307 finite-numberp-mapup-cc, 374 finite-numberp-mapup-error, 374 finite-numberp-mapup-svcflag, 374 finite-numberp-mapup-svcid, 374 finite-numberp-member, 49 finite-numberp-min-difference-me

mlength-base-limit, 131 finite-numberp-os-destid, 758 finite-numberp-os-message, 276 finite-numberp-os-srcid, 774 finite-numberp-os-taskid, 365 finite-numberp-qfirst, 66 finite-numberp-remainder, 50 finite-numberp-tm-base, 121 finite-numberp-tm-cc, 121 finite-numberp-tm-cc-value, 116 finite-numberp-tm-clock, 122 finite-numberp-tm-decr, 91 finite-numberp-tm-error, 121 finite-numberp-tm-fetch, 132 finite-numberp-tm-fetch-from-ad

dress-space, 209 finite-numberp-tm-fetch-from-me

mory-in-supervisor-mode, 131 finite-numberp-tm-fetch-in-supe

rvisor-mode, 156 finite-numberp-tm-good-address, 160 finite-numberp-tm-good-address-

for-address-space, 209 finite-numberp-tm-ichar-getnth-

crock, 127 finite-numberp-tm-incr, 91 finite-numberp-tm-incr-memlengt

h, 213 finite-numberp-tm-incrn, 91 finite-numberp-tm-interrupting-

output-port, 125

output-port-crock, 127

output-port-tm-wordlub, 126 finite-numberp-tm-interrupting-i

nput-port, 125

nput-port-crock, 127

nput-port-tm-wordlub, 125 finite-numberp-tm-limit, 121 finite-numberp-tm-overflow-char, 127

-tm-wordlub, 127 finite-numberp-tm-pack-psw, 122 finite-numberp-tm-pack-psw1, 98 finite-numberp-tm-pc, 122 finite-numberp-tm-rwstate, 123 finite-numberp-tm-slimit, 121 finite-numberp-tm-sp, 122 finite-numberp-tm-svcflag, 122 finite-numberp-tm-svcid, 122 finite-numberp-tm-svmode, 122 finite-numberp-tm-unpack-cc, 98 finite-numberp-tm-unpack-error, 98 finite-numberp-tm-unpack-svcfla

g, 99 finite-numberp-tm-unpack-svcid, 99 finite-segment-tablep, 194, 364, 374 finite-segment-tablep-os-segment

-table, 364 firstn, 29, 37, 53, 54, 56, 61, 62, 346,

356, 376 firstn-firstn, 54 firstn-fixlength, 62 firstn-for-length, 54 firstn-n-times, 346 firstn-nthcdr, 54 firstn-with-small-recursion, 346, 347 firstn-zero, 54 fixlength, 29, 32, 33, 48, 52, 53, 62,

393 fixlength-idempotence, 48 fixlength-noop, 48 fixlength-of-length-0, 48 flatten, 55, 57, 61

getnth, 28, 30, 33–36, 38, 40, 41, 45, 47, 50, 53, 56, 58–62, 67–74, 77–84, 97, 100–102, 114, 120, 121, 123–130, 195, 272, 275, 277–282, 285–289, 291, 292, 294–297, 299–306, 312, 314–316, 352–357, 362, 363, 365–372, 374, 379, 380, 386, 387, 391–394, 396–399, 403–405, 407, 408, 410–418, 420–427, 429–436, 477, 480, 482, 485, 492, 494, 496, 497, 512, 514, 517, 519, 526, 529, 531, 532, 582, 600, 602, 603, 605, 621, 623–625, 630, 641, 643, 645, 647, 648, 650, 652, 668, 670–672, 677, 689, 699, 701–704, 709, 716, 718, 720, 730, 732, 734–737, 740, 741, 744, 747, 748, 751, 754, 755, 757–760, 762–764, 767, 769– 771, 773–776, 778–780, 782, 783, 785, 786, 788, 790, 793, 795, 796, 798–803, 806–808, 810–813, 815–817, 819, 820, 822, 823, 825–827, 829–831, 834–836, 838–840, 842–844, 846–848, 850–852, 854–856, 858–860, 862, 863, 865, 866, 868–871, 873–875, 877, 878, 880, 881, 889, 898, 899, 909, 917, 919, 920, 924, 926, 927, 934, 943–946, 951, 953, 954, 960, 961, 968, 969, 975, 977, 978, 985, 990, 991, 996, 998, 1000, 1003, 1005, 1007, 1010, 1012, 1013, 1016, 1017, 1020, 1021, 1023, 1024, 1026–1044, 1046–1048, 1051–1053, 1055, 1056, 1060, 1063, 1064, 1067, 1070, 1074, 1078–1091, 1094, 1095, 1099, 1100, 1102

getnth-0-2, 33 getnth-1-2, 34 getnth-after-putseg, 36 getnth-append-casesplit, 34 getnth-append-for-length-left, 34 getnth-append-left, 35 getnth-append-right, 35 getnth-before-putseg, 36 getnth-getseg, 36 getnth-getseg-induction, 35 getnth-getseg-inverse, 36 getnth-getseg-zero-index, 35 getnth-mapup-queue-list, 372 getnth-mapup-tasks, 391 getnth-mapup-tasks-corollary, 1100 getnth-mapup-tasks-corollary2, 391 getnth-nthcdr, 58 getnth-os-code, 393 getnth-plus-1-is-cadr-getseg, 62 getnth-plus-1-is-cadr-getseg-inve

rse, 62 getnth-plus-1-is-cadr-nthcdr, 61 getnth-putnth-casesplit, 35 getnth-putnth-coincidence, 35 getnth-putnth-coincidence1, 47 getnth-putnth-non-interference, 35 getnth-putseg-coincidence, 36 getnth-table, 58 getnth-table-inverse, 58 getnth-tm-reglength-tm-cpu, 387 getnth-with-non-number-index, 34 getnth2, 47, 48, 84, 278, 295, 356,

368, 416 getnth2-putnth2-coincidence, 47 getnth2-putnth2-non-interference

1, 47 2, 48

getseg, 28, 30–32, 35, 36, 40–47, 51, 52, 55, 56, 58, 62, 69, 71, 72, 74, 77, 79, 81–83, 130, 195–200, 216, 348, 352–354, 357, 370, 376, 379, 399, 403, 432, 434, 435, 887, 893, 897, 903, 907, 913, 921, 928, 932, 938, 947, 955, 959, 965, 971, 976, 982, 988, 994, 1001, 1007, 1014, 1018, 1022, 1025, 1031, 1037, 1038, 1044, 1048, 1053, 1057, 1064, 1071, 1075, 1079, 1085, 1091, 1095

getseg-across-append, 41 getseg-add1-cons, 40 getseg-add1-length, 40 getseg-add1-length2, 41 getseg-after-putnth, 41 getseg-after-putseg, 42 getseg-append-left, 41 getseg-append-right, 41 getseg-around-putseg, 44 getseg-around-putseg-proof, 43 getseg-before-putnth, 42 getseg-before-putseg, 42 getseg-equals-firstn-nthcdr, 56 getseg-fixlength, 62 getseg-for-length, 56 getseg-getseg, 42 getseg-length-1, 40 getseg-length-1-rule, 41 getseg-must-be-nil, 45 getseg-nthcdr, 58 getseg-nthcdr-proof, 58 getseg-of-length-zero, 40 getseg-putnth-coincidence, 42 getseg-putseg-induction, 43 getseg-tm-memory-os-clock-inter

rupt-handler, 887 getseg-tm-memory-os-error-handle

r-path1, 893 r-path2, 897

getseg-tm-memory-os-running-inp ut-handler-path1, 1025 ut-handler-path2, 1031 ut-handler-path3, 1037 ut-handler-path4, 1043 ut-handler-path5, 1048 ut-handler-path6, 1052

getseg-tm-memory-os-running-outp ut-handler-path1, 1079 ut-handler-path2, 1085 ut-handler-path3, 1091 ut-handler-path4, 1095

getseg-tm-memory-os-svc-receive -handler-path1, 928 -handler-path2, 932 -handler-path3, 938 -handler-path4, 947

getseg-tm-memory-os-svc-send-ha ndler-path1, 903 ndler-path2, 907 ndler-path3, 913 ndler-path4, 921

getseg-tm-memory-os-svc-tyi-han dler-path1, 955 dler-path2, 959 dler-path3, 965

getseg-tm-memory-os-svc-tyo-han dler-path1, 971 dler-path2, 976 dler-path3, 982 dler-path4, 988 getseg-tm-memory-os-waiting-inp ut-handler-path1, 993 ut-handler-path2, 1001 ut-handler-path3, 1007 ut-handler-path4, 1014 ut-handler-path5, 1018 ut-handler-path6, 1021 getseg-tm-memory-os-waiting-outp ut-handler-path1, 1057 ut-handler-path2, 1064 ut-handler-path3, 1071 ut-handler-path4, 1075 getseg-with-non-number-index, 40 getseg-with-small-recursion, 347 getseg-within-putseg, 42 good-address-space, 205–216, 276, 277, 290, 291, 294, 375 good-address-space-base-limit-p

roperty, 208 good-address-space-getnth, 291 good-address-space-getnth-from-

ak, 294 good-address-space-list, 290, 291, 294,

375 good-address-space-list-ak-pstate

s, 294 good-address-space-list-mapup-o

s-tasks, 375 good-address-space-list-mapup-t

asks, 375 good-address-space-list-putnth, 291 good-address-space-mapup-task, 375 good-address-space-os-store-mes

sage, 276 sage1, 276

good-address-space-properties, 208 good-address-space-tm-decrement

-clock, 216 good-address-space-tm-execute, 216 good-address-space-tm-execute-a

dd, 210 good-address-space-tm-execute-b

ranch, 211

ranch-not-zero, 211

ranch-on-zero, 211 good-address-space-tm-execute-bi

nary, 216 good-address-space-tm-execute-c

all, 211 ompare, 211

good-address-space-tm-execute-de cr, 211 cr-mod, 212

good-address-space-tm-execute-i ncr, 212 ncr-mod, 212 nstruction, 216

good-address-space-tm-execute-l oad-base, 212 oad-limit, 212 oad-psw, 212

good-address-space-tm-execute-m od, 213 ove, 213 ultiply, 213

good-address-space-tm-execute-n

ullary, 215 good-address-space-tm-execute-p

ost-output-interrupt, 215 good-address-space-tm-execute-r

un, 214 good-address-space-tm-execute-ret

urn, 214 good-address-space-tm-execute-set

-clock, 214 good-address-space-tm-execute-st

art-output, 215 good-address-space-tm-execute-sv

c, 215 c-return, 215

good-address-space-tm-execute-te st-iport, 214 st-oport, 214

good-address-space-tm-execute-u

nary, 215 good-address-space-tm-execute-w

ait, 214 good-address-space-tm-fetch-exe

cute, 216 good-address-space-tm-set-cc, 210 good-address-space-tm-set-error, 210 good-address-space-tm-set-pc, 210 good-address-space-tm-set-sp, 210 good-address-space-tm-set-svcfl

ag, 210 good-address-space-tm-set-svcid, 210 good-address-space-tm-store, 209 good-ak, 293–298, 302–310, 314–317,

377 good-ak-ak-block-input, 305 good-ak-ak-block-output, 304 good-ak-ak-block-receive, 303 good-ak-ak-block-send, 303 good-ak-ak-clock-interrupt-hand

ler, 303 good-ak-ak-error-handler, 302 good-ak-ak-execute-input, 305 good-ak-ak-execute-input-from-b

uffer, 305 good-ak-ak-execute-output, 305 good-ak-ak-execute-output-to-bu

ffer, 305 good-ak-ak-execute-receive, 304 good-ak-ak-execute-receive-from

-buffer, 304 good-ak-ak-execute-send, 303 good-ak-ak-execute-send-to-buffe

r, 303 good-ak-ak-input-interrupt-hand

ler, 308 good-ak-ak-output-interrupt-han

dler, 309 good-ak-ak-post-input-interrupt, 309 good-ak-ak-post-interrupt, 310 good-ak-ak-post-interrupt-noop, 309 good-ak-ak-post-output-interrupt, 309 good-ak-ak-private-step, 306 good-ak-ak-processor, 310 good-ak-ak-running-input-interr

upt-handler, 307

upt-handler-case1, 307 upt-handler-case2, 307 good-ak-ak-running-output-inter

rupt-handler, 309 rupt-handler-case1, 308 rupt-handler-case2, 308

good-ak-ak-step, 309 good-ak-ak-svc-handler, 306 good-ak-ak-waiting-input-interr

upt-handler, 307 upt-handler-case1, 307 upt-handler-case2, 307

good-ak-ak-waiting-output-inter rupt-handler, 308 rupt-handler-case1, 308 rupt-handler-case2, 308

good-ak-construction, 292 good-ak-ibuffers-properties, 305 good-ak-mapup-os, 377 good-ak-obuffers-properties, 304 good-ak-properties, 298 good-cpu, 128, 129 good-cpu-getnth, 129 good-cpu-list, 128, 129, 363, 404, 772,

787 good-cpu-list-os-new-task-table, 404 good-cpu-list-os-task-table, 363 good-cpu-list-os-task-table-wit

h-delivered-character, 787 h-delivered-message, 771

good-cpu-list-putnth, 129 good-cpu-tm-cpu, 129 good-memory-address-implies-non

-zero-limit-for-address-space, 208 good-os, 360, 362–365, 369, 370, 373–

378, 380–388, 390–393, 404, 407, 410–412, 418, 420, 421, 425, 427, 429, 432–436, 439, 440, 442, 444, 446–448, 450, 452, 454, 455, 457, 458, 460, 461, 463, 465, 467, 470, 472, 475, 477, 480, 482, 484, 486– 489, 492, 494, 496, 498, 500, 503, 505, 507, 509, 512, 514, 517, 519, 521, 522, 524, 526, 528, 531–533, 535, 537, 539, 541, 543, 546, 548–550, 552, 553, 555, 557, 560, 562, 564, 566, 568, 570, 572, 573, 575– 578, 580, 582, 585, 588, 590, 593, 596, 598, 600, 601, 603, 605, 608, 611, 613, 616, 618, 620, 621, 623–625, 628, 630, 633, 636, 638, 641, 643, 645, 647, 648, 650, 652, 655, 658, 661, 663, 665, 666, 668, 670, 671, 673–675, 677, 680, 682, 685, 687, 689, 691, 694, 695, 697, 699, 700, 702–704, 706, 709, 711, 714, 716, 718, 720, 722, 725, 727, 729, 730, 732, 733, 735–740, 743, 744, 746, 747, 750, 753, 754, 756–759, 761–763, 765, 766, 768–775, 777–779, 781, 782, 784, 785, 787–789, 791, 792, 794–799, 801–807, 809–816, 818, 819, 821, 822, 824–826, 828–830, 832–835, 837–843, 845–848, 850, 851, 853–855, 857–859, 862, 864, 865, 868–870, 872– 874, 877, 879–884, 886, 887, 889–993, 996–1001, 1003– 1007, 1009–1057, 1060–1064, 1066–1105

good-os-bos-processor, 886 good-os-btimed-tm-processor, 886 good-os-os-clock-interrupt-hand

ler, 740 good-os-os-error-handler, 747 good-os-os-error-handler-path1, 743 good-os-os-error-handler-path2, 747 good-os-os-input-interrupt-hand

ler, 883 good-os-os-output-interrupt-han

dler, 883 good-os-os-processor, 884 good-os-os-running-input-handle

r, 850 r-path1, 830 r-path2, 835 r-path3, 839 r-path4, 843 r-path5, 846 r-path6, 850

good-os-os-running-output-handle r, 881 r-path1, 869 r-path2, 874 r-path3, 877 r-path4, 880

good-os-os-step, 884 good-os-os-svc-handler, 882 good-os-os-svc-receive-handler, 779 good-os-os-svc-receive-handler-p

ath1, 766 ath2, 769 ath3, 774 ath4, 778

good-os-os-svc-send-handler, 763 good-os-os-svc-send-handler-pat

h1, 750 h2, 754 h3, 758 h4, 762

good-os-os-svc-tyi-handler, 789 good-os-os-svc-tyi-handler-path

1, 782 2, 785 3, 789

good-os-os-svc-tyo-handler, 802 good-os-os-svc-tyo-handler-path

1, 792 2, 795 3, 799 4, 802

good-os-os-waiting-input-handle r, 825 r-path1, 807 r-path2, 811 r-path3, 816 r-path4, 819 r-path5, 822 r-path6, 825 good-os-os-waiting-output-handle

r, 865

r-path1, 855 r-path2, 859 r-path3, 862 r-path4, 865

good-os-properties, 365 good-os-properties-crock, 388 good-os-properties1, 395 good-os-timed-tm-step, 886 good-os-tm-decrement-clock, 385 good-os-tm-execute, 385 good-os-tm-execute-add, 381 good-os-tm-execute-binary, 384 good-os-tm-execute-branch, 381 good-os-tm-execute-branch-not-ze

ro, 381 good-os-tm-execute-branch-on-ze

ro, 381 good-os-tm-execute-call, 381 good-os-tm-execute-compare, 381 good-os-tm-execute-decr, 381 good-os-tm-execute-decr-mod, 382 good-os-tm-execute-incr, 382 good-os-tm-execute-incr-mod, 382 good-os-tm-execute-instruction, 384 good-os-tm-execute-load-base, 382 good-os-tm-execute-load-limit, 382 good-os-tm-execute-load-psw, 382 good-os-tm-execute-mod, 382 good-os-tm-execute-move, 383 good-os-tm-execute-multiply, 383 good-os-tm-execute-nullary, 384 good-os-tm-execute-post-output-i

nterrupt, 383 good-os-tm-execute-return, 383 good-os-tm-execute-run, 383 good-os-tm-execute-set-clock, 383 good-os-tm-execute-start-output, 383 good-os-tm-execute-svc, 383 good-os-tm-execute-svc-return, 384 good-os-tm-execute-test-iport, 384 good-os-tm-execute-test-oport, 384 good-os-tm-execute-unary, 384 good-os-tm-execute-wait, 384 good-os-tm-fetch-execute, 385 good-os-tm-post-interrupt, 385 good-os-tm-set-cc, 378 good-os-tm-set-error, 378 good-os-tm-set-iports, 385 good-os-tm-set-oports, 385 good-os-tm-set-pc, 378 good-os-tm-set-sp, 378 good-os-tm-set-svcflag, 378 good-os-tm-set-svcid, 378 good-os-tm-store, 380 good-os-tm-store-in-memory, 380 good-os-tm-store-in-regmem, 378 good-status, 291, 296, 304 good-status-getnth, 291 good-status-getnth-from-ak-stat

us, 296 good-status-list, 291, 296, 363, 743,

746, 805, 810, 814, 829, 833, 838, 853, 858, 868, 872

good-status-list-ak-status, 296 good-status-list-os-status-table, 363

-os-error-handler-path1, 743 -os-error-handler-path2, 746 -os-running-input-handler-path1,

829 -os-running-input-handler-path2,

833 -os-running-input-handler-path3,

838 -os-running-output-handler-path1,

868 -os-running-output-handler-path2,

872 -os-waiting-input-handler-path1,

805 -os-waiting-input-handler-path2,

810 -os-waiting-input-handler-path3,

814 -os-waiting-output-handler-path1,

853 -os-waiting-output-handler-path2,

858 good-status-list-putnth, 291 good-status-properties, 304 good-task, 277 good-task-buffer, 276–278, 294, 295,

375 good-task-buffer-getnth, 277 good-task-buffer-getnth-from-ak

-ibuffers, 294 -obuffers, 295

good-task-buffer-getnth2, 278 good-task-buffer-getnth2-from-a

k-mbuffers, 295 good-task-buffer-list, 276–278, 294,

295, 375–377 good-task-buffer-list-ak-ibuffe

rs, 294 good-task-buffer-list-ak-obuffe

rs, 295 good-task-buffer-list-firstn, 376 good-task-buffer-list-getnth, 278 good-task-buffer-list-getseg, 376 good-task-buffer-list-mapup-os-

obuffers, 376 good-task-buffer-list-mapup-os-i

buffers, 376 good-task-buffer-list-mapup-que

ue-list, 375 good-task-buffer-list-nthcdr, 376 good-task-buffer-list-putnth, 278 good-task-buffer-mapup-queue, 375 good-task-buffer-properties, 277 good-task-buffer-table, 277–279, 295,

377 good-task-buffer-table-ak-mbuffe

rs, 295 good-task-buffer-table-mapup-os

-mbuffers, 377 good-task-buffer-table-putnth, 278 good-task-buffer-table-putnth2, 278 good-task-buffer-table-table, 377 good-tm, 120–127, 129–133, 135–144,

146–148, 150–152, 154–160, 162, 163, 217–220, 225–246, 248–254, 256–260, 262–271, 360, 378, 379, 405, 410, 420, 429, 736–742, 744–749, 751– 753, 755–757, 759–761, 763– 773, 775–777, 779–805, 807– 809, 812–814, 816–828, 831– 833, 835–837, 840–845, 847– 853, 855–857, 859–864, 866– 868, 870–872, 874–880, 919, 926, 945, 953, 970, 987, 992, 1030, 1036, 1042, 1047, 1051, 1056, 1083, 1089, 1094, 1098

good-tm-iport, 118, 123, 124, 297,

306 good-tm-iport-array, 118, 123, 124,

126, 150, 163, 290, 297, 385 good-tm-iport-array-ak-iports, 297 good-tm-iport-array-putnth, 124 good-tm-iport-array-putnth-into

-tm-iports, 124 good-tm-iport-array-putnth1, 290 good-tm-iport-array-tm-iports, 123 good-tm-iport-getnth, 123 good-tm-iport-getnth-from-ak-ip

orts, 297 good-tm-iport-getnth-from-tm-ip

orts, 124 good-tm-iport-getnth-properties, 125 good-tm-iport-properties, 306 good-tm-iports-tm-clear-input-i

nterrupt, 126 good-tm-iports-tm-post-input-inte

rrupt, 163 good-tm-oport, 118, 119, 124, 297,

308 good-tm-oport-array, 119, 123, 124,

126, 151, 159, 290, 297, 385 good-tm-oport-array-ak-oports, 297 good-tm-oport-array-putnth, 124 good-tm-oport-array-putnth-into

-tm-oports, 124 good-tm-oport-array-putnth1, 290 good-tm-oport-array-tm-oports, 123 good-tm-oport-getnth, 124 good-tm-oport-getnth-from-ak-op

orts, 297 good-tm-oport-getnth-from-tm-op

orts, 124 good-tm-oport-getnth-properties, 126 good-tm-oport-properties, 308 good-tm-oports-tm-clear-output-i

nterrupt, 126 good-tm-oports-tm-post-output-i

nterrupt, 159 good-tm-oports-tm-start-output, 159 good-tm-os, 360 good-tm-os-clock-interrupt-hand

ler, 737 good-tm-os-error-handler-path1, 740 good-tm-os-error-handler-path2, 744 good-tm-os-intended-clock-inter

rupt, 736 good-tm-os-intended-error-inter

rupt, 740 good-tm-os-intended-input-inter

rupt, 802 good-tm-os-intended-output-inte

rrupt, 850 good-tm-os-intended-svc-receive

-interrupt, 763 good-tm-os-intended-svc-send-inte

rrupt, 747 good-tm-os-intended-svc-tyi-inte

rrupt, 779 good-tm-os-intended-svc-tyo-inte

rrupt, 789 good-tm-os-running-input-handle

r-path1, 826 r-path2, 830 r-path3, 835 r-path4, 840 r-path5, 843 r-path6, 847

good-tm-os-running-output-handle r-path1, 865 r-path2, 870 r-path3, 874

r-path4, 877 good-tm-os-svc-receive-handler-p

ath1, 763 ath2, 766 ath3, 770 ath4, 775

good-tm-os-svc-send-handler-pat h1, 747 h2, 750 h3, 754 h4, 759

good-tm-os-svc-tyi-handler-path 1, 779 2, 782 3, 785

good-tm-os-svc-tyo-handler-path 1, 789 2, 792 3, 796 4, 799

good-tm-os-waiting-input-handle r-path1, 803 r-path2, 807 r-path3, 812 r-path4, 816 r-path5, 819 r-path6, 822

good-tm-os-waiting-output-handle r-path1, 851 r-path2, 855 r-path3, 859 r-path4, 862

good-tm-properties, 130 good-tm-tm-decrement-clock, 160 good-tm-tm-execute, 160 good-tm-tm-execute-add, 155 good-tm-tm-execute-binary, 160 good-tm-tm-execute-branch, 155 good-tm-tm-execute-branch-not-ze

ro, 155 good-tm-tm-execute-branch-on-ze

ro, 155 good-tm-tm-execute-call, 155 good-tm-tm-execute-clock-interr

upt, 162 good-tm-tm-execute-compare, 155 good-tm-tm-execute-decr, 155 good-tm-tm-execute-decr-mod, 156 good-tm-tm-execute-error-interr

upt, 162 good-tm-tm-execute-incr, 156 good-tm-tm-execute-incr-mod, 156 good-tm-tm-execute-input-interr

upt, 162 good-tm-tm-execute-instruction, 160 good-tm-tm-execute-load-base, 156 good-tm-tm-execute-load-limit, 156 good-tm-tm-execute-load-psw, 157 good-tm-tm-execute-mod, 157 good-tm-tm-execute-move, 157 good-tm-tm-execute-multiply, 157 good-tm-tm-execute-nullary, 159 good-tm-tm-execute-output-inter

rupt, 163 good-tm-tm-execute-post-output-i

nterrupt, 159 good-tm-tm-execute-return, 158 good-tm-tm-execute-run, 158 good-tm-tm-execute-set-clock, 158 good-tm-tm-execute-start-output, 159 good-tm-tm-execute-svc, 159 good-tm-tm-execute-svc-interrupt, 162 good-tm-tm-execute-svc-return, 159 good-tm-tm-execute-test-iport, 158 good-tm-tm-execute-test-oport, 158 good-tm-tm-execute-unary, 160 good-tm-tm-execute-wait, 158 good-tm-tm-fetch-execute, 162 good-tm-tm-post-interrupt, 163 good-tm-tm-processor, 163 good-tm-tm-set-base, 139 good-tm-tm-set-cc, 136 good-tm-tm-set-clock, 148 good-tm-tm-set-error, 137 good-tm-tm-set-iports, 150 good-tm-tm-set-limit, 140 good-tm-tm-set-memory, 135 good-tm-tm-set-oports, 151 good-tm-tm-set-pc, 152 good-tm-tm-set-regs, 133 good-tm-tm-set-rwstate, 147 good-tm-tm-set-slimit, 141 good-tm-tm-set-sp, 154 good-tm-tm-set-svcflag, 144 good-tm-tm-set-svcid, 146 good-tm-tm-set-svmode, 143 good-tm-tm-step, 163 good-tm-tm-store, 133

half-plus, 10

if-times-then-divides, 9 incr-dc-position, 325, 328 incr-instruction-position, 325, 328 incr-mod, 63, 64, 67, 70, 71, 80, 81,

85, 88, 392 incr-mod-decr-mod, 64 incr-mod-equals-remainder-add1, 63 index-ready-set, 292, 298–302, 357,

370, 743, 746, 750, 753, 757, 765, 768, 773, 781, 784, 791, 794, 805, 810, 815, 829, 833, 838, 853, 858, 868, 873

index-ready-set-putnth-ready-st

atus, 301 index-ready-set-putnth-unready-

status, 299 index-within-length-of-ibuffer, 420 index-within-length-of-mbuffer, 411 index-within-length-of-mbuffer-

for-receive, 413 insert, 23–25, 27, 28, 301 insert-remove, 24 integer-equality-crock, 19 integer-induction-instance, 42 integer-inequality-casesplit, 19 integer-nthcdr-induction, 57, 58

length, 23, 24, 29, 31–44, 47, 48, 50–66, 68–71, 73, 77, 79– 84, 111, 120, 121, 123–126, 128–130, 133, 135, 150, 151, 159, 163, 195, 200–204, 206, 209, 264, 265, 273, 274, 276– 278, 290, 291, 294–297, 299– 302, 304, 305, 310–312, 314, 316, 317, 322, 324, 325, 328, 348–350, 352, 353, 355–357, 365, 367–369, 372–377, 379, 380, 385, 386, 397–399, 404, 415, 416, 424, 425, 431, 433, 435, 1105

length-address-space-memory, 206 length-address-space-regs, 206 length-ak-ibuffers, 294 length-ak-iports, 297 length-ak-mbuffers, 295 length-ak-obuffers, 294 length-ak-oports, 297 length-ak-pstates, 294 length-ak-pstates-ak-execute-inp

ut, 311

ut-from-buffer, 311 length-ak-pstates-ak-execute-outp

ut, 311

ut-to-buffer, 311 length-ak-pstates-ak-execute-re

ceive, 311

ceive-from-buffer, 311 length-ak-pstates-ak-execute-se

nd, 310

nd-to-buffer, 310 length-ak-pstates-ak-private-step, 312 length-ak-pstates-ak-step, 312 length-ak-pstates-ak-svc-handle

r, 312 length-ak-readyq, 296 length-ak-status, 296 length-append, 32 length-array-deq, 71 length-array-enq, 70 length-array-nonlast, 73 length-array-qarray, 69 length-array-qreplace, 77 length-array-queue, 68 length-delta-segment, 79 length-delta-segment-a-a, 81 length-delta-segment-decr-mod-a

rg1, 82 length-deq, 65 length-enq, 64 length-finite-number-queue, 353 length-finite-number-queue-coro

llary, 365

llary-for-ibuffers, 416 llary-for-mbuffers, 367 llary-for-obuffers, 425

length-firstn, 53 length-fixlength, 33 length-flatten, 57 length-getnth-from-table, 56 length-getnth-table, 56 length-getseg, 32 length-insert, 24 length-mapup-cpu, 373 length-mapup-os-ibuffers, 375 length-mapup-os-mbuffers, 376 length-mapup-os-obuffers, 376 length-mapup-os-tasks, 373 length-mapup-queue, 80 length-mapup-queue-is-qcurrlengt

h, 84 length-mapup-queue-list, 372 length-mapup-regs, 373 length-mapup-tasks, 373 length-non-empty-queue, 64 length-nonlast, 62 length-nthcdr, 53 length-of-nthcdr-goes-down, 55 length-os-code, 352 length-os-ibuffers, 349 length-os-ibuffers-with-dequeue

d-character, 424 length-os-ibuffers-with-enqueue

d-character, 425

d-overflow-character, 424 length-os-ibuffers-with-qreplace

d-overflow-character, 424 length-os-mbuffers, 350 length-os-mbuffers-with-dequeue

d-message, 415 length-os-mbuffers-with-enqueue

d-message, 415 length-os-obuffers, 350 length-os-obuffers-with-dequeue

d-character, 431 length-os-obuffers-with-enqueue

d-character, 431 length-os-readyq, 349 length-os-segment-table, 349 length-os-status-table, 349 length-os-task-table, 348 length-os-task-table-with-delive red-character, 433 red-message, 435 length-permutation, 24 length-putnth, 32 length-putnth2, 47 length-putseg, 32 length-qreplace, 65 length-remove, 24 length-table, 56 length-tm-cpu, 129 length-tm-iports, 123 length-tm-memory, 120 length-tm-memory-mapup-task, 375 length-tm-memory-os-store-messa

ge, 276 length-tm-memory-tm-execute, 204 length-tm-memory-tm-execute-add,

200 length-tm-memory-tm-execute-bin

ary, 204 length-tm-memory-tm-execute-bra

nch, 200

nch-not-zero, 201 nch-on-zero, 201

length-tm-memory-tm-execute-cal

l, 201 length-tm-memory-tm-execute-comp

are, 201 length-tm-memory-tm-execute-dec

r, 201 r-mod, 201 length-tm-memory-tm-execute-inc

r, 201 r-mod, 202

length-tm-memory-tm-execute-inst

ruction, 204 length-tm-memory-tm-execute-loa

d-base, 202 d-limit, 202 d-psw, 202

length-tm-memory-tm-execute-mod,

202 length-tm-memory-tm-execute-move,

202 length-tm-memory-tm-execute-multip

ly, 202 length-tm-memory-tm-execute-nul

lary, 204 length-tm-memory-tm-execute-post

-output-interrupt, 203 length-tm-memory-tm-execute-ret

urn, 202 length-tm-memory-tm-execute-run, 203 length-tm-memory-tm-execute-set

-clock, 203 length-tm-memory-tm-execute-sta

rt-output, 203 length-tm-memory-tm-execute-svc, 203

-return, 204 length-tm-memory-tm-execute-test

-iport, 203 -oport, 203

length-tm-memory-tm-execute-una

ry, 204 length-tm-memory-tm-execute-wait,

203 length-tm-memory-tm-fetch-execute,

204 length-tm-memory-tm-store, 200 length-tm-oports, 123 length-tm-regs, 121 leq-casesplit, 19 leq-delta, 67 leq-number-of-ready-tasks-lengt

h-status, 300 leq-plus, 18 leq-plus-base-limit-getnth, 374 leq-plus-base-limit-getnth-coro

llary, 374 leq-plus-mapup-base-mapup-limit, 374 leq-plus-times, 19 leq-plus1, 18 leq-plus2, 19 leq-times, 18 lessp-4-crock, 882 lessp-alu-value-tm-alu-decr-mod

-wordsize, 86

-wordsize-linear, 86 lessp-alu-value-tm-alu-decr-wor

dsize, 86

dsize-linear, 86 lessp-alu-value-tm-alu-incr-mod

-wordsize, 88

-wordsize-linear, 88 lessp-alu-value-tm-alu-incr-wor

dsize, 87

dsize-linear, 87 lessp-alu-value-tm-alu-mod-word

size, 88

size-linear, 88 lessp-alu-value-tm-alu-mult-wor

dsize, 89

dsize-linear, 89 lessp-alu-value-tm-alu-plus-wor

dsize, 89

dsize-linear, 89 lessp-car-index-ready-set, 301 lessp-car-index-ready-set-insta

nce, 301 lessp-crock-for-good-cpu-list-o

s-task-table-with-delivered-message,

771 lessp-difference, 19 lessp-getnth, 50 lessp-getnth-linear, 50 lessp-good-memory-address-limit, 218 lessp-incr-mod, 64 lessp-number-of-ready-tasks-len

gth-status, 301 lessp-plus-base-addr-memlength, 132 lessp-plus-cancelation, 7 lessp-plus-cancellation3, 8 lessp-plus-fact-for-mbuffers-fo

r-receive1, 412 r-receive2, 412

lessp-plus-fact-for-mbuffers1, 411 lessp-plus-fact-for-mbuffers2, 411 lessp-plus-facts-for-ibuffers, 420 lessp-plus-facts-for-obuffers, 429 lessp-qcurrlength-add1-qmaxlengt

h, 69 lessp-qfirst-mapup-queue-os-rea

dyq, 377 lessp-qhead-qmaxlength, 69 lessp-qmaxlength-field-os-curre

nt-ibuffer-tm-wordlub, 420 nt-obuffer-tm-wordlub, 429

lessp-qtail-qmaxlength, 69 lessp-quotient, 21 lessp-quotient-induction, 20 lessp-quotient-quotient, 21 lessp-quotient-quotient-inducti

on, 21 lessp-quotient-remainder, 20 lessp-quotient-remainder-crock, 20 lessp-quotient-times, 20 lessp-quotient1, 6 lessp-remainder-divisor, 12 lessp-remainder-remainder, 19 lessp-remainder-sub1-crock, 18 lessp-remainder1, 6 lessp-remainder2, 5 lessp-times, 19 lessp-times-1, 5 lessp-times-2, 6 lessp-times-cancellation, 8 lessp-times-quotient, 21 lessp-tm-cc-value-tm-cclub, 116 lessp-tm-cc-value-tm-cclub-line

ar, 116 lessp-transitivity, 20 limit, 194, 195, 363, 371, 374, 379,

380, 386, 387, 403, 404, 740, 747, 754, 758, 762, 769, 774, 778, 785, 788, 795, 798, 802, 806, 807, 811, 815, 816, 830, 834, 839, 843, 846, 850, 854, 859, 869, 874, 877, 880

limited-associativity-of-plus, 406 limited-associativity-of-plus2, 416 list-getnth-0, 34 list-of-getnths8, 130 list-of-getnths9, 397 list-of-putnths8, 398 listp-append, 29 listp-append-left, 29 listp-getseg, 30 listp-implies-non-zero-length, 29 listp-nthcdr, 53 listp-putnth, 30 listp-putseg, 30 listp-table, 57 lookup, 318–323, 327, 331

mapup-address-space, 216, 218–247, 249–272, 371, 387 mapup-base, 371, 373, 374, 887, 893,

896, 897, 903, 907, 913, 920, 921, 928, 931, 932, 938, 947, 954, 955, 958, 959, 965, 971, 975, 976, 981, 982, 987, 988, 993, 994, 1000, 1001, 1007, 1014, 1018, 1021, 1022, 1025, 1031, 1037, 1043, 1044, 1048, 1052, 1053, 1057, 1064, 1071, 1074, 1075, 1078, 1079, 1084, 1085, 1090, 1091, 1095

mapup-base-os-clock-interrupt-h

andler, 887 mapup-base-os-error-handler-pat

h1, 893 h2, 896

mapup-base-os-running-input-han dler-path1, 1025 dler-path2, 1031 dler-path3, 1037 dler-path4, 1043 dler-path5, 1048 dler-path6, 1052

mapup-base-os-running-output-ha ndler-path1, 1078 ndler-path2, 1084 ndler-path3, 1090 ndler-path4, 1095

mapup-base-os-svc-receive-handle r-path1, 928 r-path2, 931 r-path3, 938 r-path4, 946

mapup-base-os-svc-send-handler-p ath1, 903 ath2, 906 ath3, 913 ath4, 920

mapup-base-os-svc-tyi-handler-p ath1, 954 ath2, 958 ath3, 965

mapup-base-os-svc-tyo-handler-p ath1, 971 ath2, 975 ath3, 981 ath4, 987

mapup-base-os-waiting-input-han dler-path1, 993 dler-path2, 1000 dler-path3, 1007 dler-path4, 1014 dler-path5, 1018 dler-path6, 1021

mapup-base-os-waiting-output-ha ndler-path1, 1057 ndler-path2, 1064 ndler-path3, 1071 ndler-path4, 1074

mapup-cc, 371, 374, 890, 894, 899, 904, 910, 914, 915, 921, 922, 929, 935, 939–941, 948, 949, 955, 961, 966, 967, 972, 978, 982, 983, 988, 989, 996, 1004, 1010, 1015, 1018, 1022, 1027, 1033, 1039, 1045, 1049, 1054, 1060, 1067, 1072, 1075, 1080, 1086, 1092, 1096 mapup-cc-os-clock-interrupt-han

dler, 890 mapup-cc-os-error-handler-path1, 894 mapup-cc-os-error-handler-path2, 899 mapup-cc-os-running-input-handle

r-path1, 1027 r-path2, 1033 r-path3, 1039 r-path4, 1045 r-path5, 1049 r-path6, 1054

mapup-cc-os-running-output-hand ler-path1, 1080 ler-path2, 1086 ler-path3, 1092 ler-path4, 1096

mapup-cc-os-svc-receive-handler -path1, 928 -path2, 935 -path3, 941 -path4, 949

mapup-cc-os-svc-send-handler-pat h1, 904 h2, 910 h3, 915 h4, 922

mapup-cc-os-svc-tyi-handler-pat h1, 955 h2, 961 h3, 967

mapup-cc-os-svc-tyo-handler-pat h1, 972 h2, 978 h3, 983 h4, 989

mapup-cc-os-waiting-input-handle r-path1, 996 r-path2, 1003 r-path3, 1010 r-path4, 1015 r-path5, 1018

r-path6, 1022 mapup-cc-os-waiting-output-hand

ler-path1, 1060 ler-path2, 1067 ler-path3, 1072 ler-path4, 1075

mapup-cpu, 370, 371, 373, 889, 893, 899, 903, 909, 914, 915, 921, 922, 928, 934, 939, 940, 947, 948, 955, 961, 965, 966, 972, 978, 982, 983, 988, 989, 996, 1003, 1010, 1014, 1018, 1022, 1026, 1032, 1038, 1044, 1049, 1053, 1060, 1067, 1071, 1075, 1080, 1085, 1091, 1096, 1103

mapup-cpu-os-clock-interrupt-ha

ndler, 889 mapup-cpu-os-error-handler-path

1, 893 2, 899

mapup-cpu-os-running-input-hand ler-path1, 1026 ler-path2, 1032 ler-path3, 1038 ler-path4, 1044 ler-path5, 1049 ler-path6, 1053

mapup-cpu-os-running-output-han dler-path1, 1079 dler-path2, 1085 dler-path3, 1091 dler-path4, 1096

mapup-cpu-os-svc-receive-handle r-path1, 928 r-path2, 934 r-path3, 940 r-path3-case1, 939 r-path3-case2, 939 r-path4, 948 r-path4-case1, 947 r-path4-case2, 948

mapup-cpu-os-svc-send-handler-p ath1, 903 ath2, 909 ath3, 914 ath3-case1, 914 ath3-case2, 914 ath4, 922 ath4-case1, 921 ath4-case2, 922

mapup-cpu-os-svc-tyi-handler-pat h1, 955 h2, 961 h3, 966 h3-case1, 965 h3-case2, 966

mapup-cpu-os-svc-tyo-handler-pat h1, 972 h2, 978 h3, 983 h3-case1, 982 h3-case2, 983 h4, 989 h4-case1, 988 h4-case2, 988

mapup-cpu-os-waiting-input-hand ler-path1, 996 ler-path2, 1003 ler-path3, 1010 ler-path4, 1014 ler-path5, 1018 ler-path6, 1022

mapup-cpu-os-waiting-output-han dler-path1, 1060 dler-path2, 1067 dler-path3, 1071 dler-path4, 1075

mapup-cpu-tm-post-interrupt, 1103 mapup-current-task-tm-fetch-exe

cute, 390 mapup-error, 371, 374, 890, 894, 900,

904, 910, 914, 915, 921–923, 929, 935, 939–941, 948, 949, 956, 962, 966, 967, 972, 979, 982–984, 988, 989, 997, 1004, 1011, 1015, 1019, 1022, 1027, 1033, 1039, 1045, 1049, 1054, 1061, 1067, 1072, 1076, 1081, 1086, 1092, 1096

mapup-error-os-clock-interrupt-

handler, 890 mapup-error-os-error-handler-pat

h1, 894 h2, 900

mapup-error-os-running-input-ha ndler-path1, 1027 ndler-path2, 1033 ndler-path3, 1039 ndler-path4, 1045 ndler-path5, 1049 ndler-path6, 1054

mapup-error-os-running-output-h andler-path1, 1080 andler-path2, 1086 andler-path3, 1092 andler-path4, 1096

mapup-error-os-svc-receive-hand ler-path1, 929 ler-path2, 935 ler-path3, 941 ler-path4, 949

mapup-error-os-svc-send-handler -path1, 904 -path2, 910 -path3, 915 -path4, 922

mapup-error-os-svc-tyi-handler-p ath1, 956 ath2, 962 ath3, 967

mapup-error-os-svc-tyo-handler-p ath1, 972 ath2, 978 ath3, 983 ath4, 989

mapup-error-os-waiting-input-ha ndler-path1, 997 ndler-path2, 1004 ndler-path3, 1010 ndler-path4, 1015 ndler-path5, 1019

ndler-path6, 1022 mapup-error-os-waiting-output-h andler-path1, 1060 andler-path2, 1067 andler-path3, 1072 andler-path4, 1076

mapup-limit, 371, 373–375, 887, 893, 896, 897, 903, 907, 913, 921, 928, 932, 938, 947, 955, 958, 959, 965, 971, 975, 976, 982, 987, 988, 993, 994, 1000, 1001, 1007, 1014, 1018, 1021, 1022, 1025, 1031, 1037, 1038, 1043, 1044, 1048, 1052, 1053, 1057, 1064, 1071, 1075, 1079, 1084, 1085, 1090, 1091, 1095

mapup-limit-os-clock-interrupt-

handler, 887 mapup-limit-os-error-handler-pat

h1, 893 h2, 896

mapup-limit-os-running-input-ha ndler-path1, 1025 ndler-path2, 1031 ndler-path3, 1037 ndler-path4, 1043 ndler-path5, 1048 ndler-path6, 1052

mapup-limit-os-running-output-h andler-path1, 1079 andler-path2, 1084 andler-path3, 1090 andler-path4, 1095 mapup-limit-os-svc-receive-hand

ler-path1, 928 ler-path2, 932 ler-path3, 938 ler-path4, 947

mapup-limit-os-svc-send-handler -path1, 903 -path2, 907 -path3, 913 -path4, 921

mapup-limit-os-svc-tyi-handler-p ath1, 955 ath2, 958 ath3, 965

mapup-limit-os-svc-tyo-handler-p ath1, 971 ath2, 975 ath3, 982 ath4, 987

mapup-limit-os-waiting-input-ha ndler-path1, 993 ndler-path2, 1000 ndler-path3, 1007 ndler-path4, 1014 ndler-path5, 1018 ndler-path6, 1021

mapup-limit-os-waiting-output-h andler-path1, 1057 andler-path2, 1064 andler-path3, 1071 andler-path4, 1075

mapup-os, 372, 377, 392, 892, 896, 902, 906, 913, 920, 926, 927, 931, 938, 946, 953, 954, 958, 964, 971, 975, 981, 987, 993, 1000, 1007, 1014, 1017, 1021, 1025, 1031, 1037, 1043, 1047, 1052, 1057, 1063, 1064, 1071, 1074, 1078, 1084, 1090, 1094, 1099–1101, 1103–1105

mapup-os-ibuffers, 372, 375, 376, 425, 891, 895, 901, 905, 911, 918, 924, 930, 936, 944, 951, 957, 963, 969, 973, 980, 985, 991, 998, 1005, 1012, 1016, 1020, 1023, 1029, 1035, 1041, 1046, 1051, 1055, 1062, 1069, 1073, 1077, 1082, 1088, 1093, 1098

mapup-os-ibuffers-os-clock-inte

rrupt-handler, 891 mapup-os-ibuffers-os-error-hand

ler-path1, 895 ler-path2, 901

mapup-os-ibuffers-os-running-inp ut-handler-path1, 1029 ut-handler-path2, 1035 ut-handler-path3, 1041 ut-handler-path4, 1046 ut-handler-path5, 1051 ut-handler-path6, 1055

mapup-os-ibuffers-os-running-outp ut-handler-path1, 1082 ut-handler-path2, 1088 ut-handler-path3, 1093 ut-handler-path4, 1098

mapup-os-ibuffers-os-svc-receive -handler-path1, 930 -handler-path2, 936 -handler-path3, 944 -handler-path4, 951

mapup-os-ibuffers-os-svc-send-h andler-path1, 905 andler-path2, 911 andler-path3, 918 andler-path4, 924

mapup-os-ibuffers-os-svc-tyi-ha ndler-path1, 957 ndler-path2, 963 ndler-path3, 969

mapup-os-ibuffers-os-svc-tyo-ha ndler-path1, 973 ndler-path2, 980 ndler-path3, 985 ndler-path4, 991

mapup-os-ibuffers-os-waiting-inp ut-handler-path1, 998 ut-handler-path2, 1005 ut-handler-path3, 1012 ut-handler-path4, 1016 ut-handler-path5, 1020 ut-handler-path6, 1023

mapup-os-ibuffers-os-waiting-outp ut-handler-path1, 1062 ut-handler-path2, 1069 ut-handler-path3, 1073 ut-handler-path4, 1077

mapup-os-mbuffers, 372, 376, 377, 416, 891, 895, 901, 905, 911, 918, 925, 930, 936, 944, 952, 957, 963, 970, 974, 980, 986, 992, 998, 1005, 1012, 1016, 1020, 1024, 1029, 1035, 1042, 1047, 1051, 1056, 1062, 1069, 1073, 1077, 1083, 1089, 1094, 1098

mapup-os-mbuffers-os-clock-inte

rrupt-handler, 891 mapup-os-mbuffers-os-error-hand

ler-path1, 895 ler-path2, 901

mapup-os-mbuffers-os-running-inp ut-handler-path1, 1029 ut-handler-path2, 1035 ut-handler-path3, 1041 ut-handler-path4, 1047 ut-handler-path5, 1051 ut-handler-path6, 1056

mapup-os-mbuffers-os-running-outp ut-handler-path1, 1083 ut-handler-path2, 1089 ut-handler-path3, 1094 ut-handler-path4, 1098

mapup-os-mbuffers-os-svc-receive -handler-path1, 930 -handler-path2, 936 -handler-path3, 944 -handler-path3-support, 944 -handler-path4, 952 -handler-path4-support, 952

mapup-os-mbuffers-os-svc-send-h andler-path1, 905 andler-path2, 911 andler-path3, 918 andler-path3-support, 918 andler-path4, 925 andler-path4-support, 925

mapup-os-mbuffers-os-svc-tyi-ha ndler-path1, 957 ndler-path2, 963 ndler-path3, 970

mapup-os-mbuffers-os-svc-tyo-ha ndler-path1, 974 ndler-path2, 980 ndler-path3, 986 ndler-path4, 992

mapup-os-mbuffers-os-waiting-inp ut-handler-path1, 998 ut-handler-path2, 1005 ut-handler-path3, 1012 ut-handler-path4, 1016 ut-handler-path5, 1020 ut-handler-path6, 1024 mapup-os-mbuffers-os-waiting-outp ut-handler-path1, 1062 ut-handler-path2, 1069 ut-handler-path3, 1073 ut-handler-path4, 1077 mapup-os-obuffers, 372, 376, 891, 895,

901, 905, 911, 918, 925, 930, 936, 944, 952, 957, 963, 969, 973, 975, 980, 986, 991, 998, 1005, 1012, 1016, 1020, 1024, 1029, 1035, 1041, 1046, 1051, 1055, 1062, 1069, 1070, 1073, 1077, 1078, 1082, 1088, 1090, 1093, 1098, 1099 mapup-os-obuffers-os-clock-inte rrupt-handler, 891 mapup-os-obuffers-os-error-hand

ler-path1, 895 ler-path2, 901

mapup-os-obuffers-os-running-inp ut-handler-path1, 1029 ut-handler-path2, 1035 ut-handler-path3, 1041 ut-handler-path4, 1046 ut-handler-path5, 1051 ut-handler-path6, 1055 mapup-os-obuffers-os-running-outp ut-handler-path1, 1082 ut-handler-path2, 1088 ut-handler-path3, 1093 ut-handler-path4, 1098 mapup-os-obuffers-os-svc-receive -handler-path1, 930 -handler-path2, 936 -handler-path3, 944

-handler-path4, 952 mapup-os-obuffers-os-svc-send-h

andler-path1, 905 andler-path2, 911 andler-path3, 918 andler-path4, 925

mapup-os-obuffers-os-svc-tyi-ha ndler-path1, 957 ndler-path2, 963 ndler-path3, 969

mapup-os-obuffers-os-svc-tyo-ha ndler-path1, 973 ndler-path2, 980 ndler-path3, 986 ndler-path4, 991

mapup-os-obuffers-os-waiting-inp ut-handler-path1, 998 ut-handler-path2, 1005 ut-handler-path3, 1012 ut-handler-path4, 1016 ut-handler-path5, 1020 ut-handler-path6, 1024

mapup-os-obuffers-os-waiting-outp ut-handler-path1, 1062 ut-handler-path2, 1069 ut-handler-path3, 1073 ut-handler-path4, 1077

mapup-os-status-table-os-clock-i

nterrupt-handler, 892 mapup-os-status-table-os-error-

handler-path1, 895 handler-path2, 902

mapup-os-status-table-os-runnin g-input-handler-path1, 1030 g-input-handler-path2, 1036 g-input-handler-path3, 1042 g-output-handler-path1, 1083 g-output-handler-path2, 1089

mapup-os-status-table-os-svc-re ceive-handler-path1, 930 ceive-handler-path2, 937 ceive-handler-path3, 945 ceive-handler-path4, 953

mapup-os-status-table-os-svc-se nd-handler-path1, 905 nd-handler-path2, 912 nd-handler-path3, 919 nd-handler-path4, 926 mapup-os-status-table-os-svc-ty o-handler-path1, 974 o-handler-path2, 980 o-handler-path3, 986 o-handler-path4, 992 mapup-os-status-table-os-svc-tyi -handler-path1, 957 -handler-path2, 964 -handler-path3, 970 mapup-os-status-table-os-waitin g-input-handler-path1, 999 g-input-handler-path2, 1006 g-input-handler-path3, 1013 g-output-handler-path1, 1062 g-output-handler-path2, 1069 mapup-os-tasks, 371–373, 375, 391,

891, 895, 901, 905, 911, 917, 924, 930, 936, 943, 951, 957, 963, 969, 973, 980, 985, 991, 998, 1005, 1012, 1016, 1019, 1023, 1029, 1035, 1041, 1046, 1050, 1055, 1062, 1069, 1073, 1076, 1082, 1088, 1093, 1097, 1100, 1102 mapup-os-tasks-os-clock-interrupt

-handler, 891 mapup-os-tasks-os-error-handler

-path1, 895 -path2, 901

mapup-os-tasks-os-running-input -handler-path1, 1029 -handler-path2, 1035 -handler-path3, 1041 -handler-path4, 1046 -handler-path5, 1050 -handler-path6, 1055 mapup-os-tasks-os-running-output -handler-path1, 1082 -handler-path2, 1088 -handler-path3, 1093

-handler-path4, 1097 mapup-os-tasks-os-svc-receive-h

andler-path1, 930 andler-path2, 936 andler-path3, 943 andler-path3-support, 943 andler-path4, 951 andler-path4-support, 951

mapup-os-tasks-os-svc-send-hand ler-path1, 905 ler-path2, 911 ler-path3, 917 ler-path3-support, 917 ler-path4, 924 ler-path4-support, 924

mapup-os-tasks-os-svc-tyi-handle r-path1, 957 r-path2, 963 r-path3, 969 r-path3-support, 969

mapup-os-tasks-os-svc-tyo-handle r-path1, 973 r-path2, 980 r-path3, 985 r-path3-support, 985 r-path4, 991 r-path4-support, 991

mapup-os-tasks-os-waiting-input -handler-path1, 998 -handler-path2, 1005 -handler-path3, 1012 -handler-path4, 1016 -handler-path5, 1019 -handler-path6, 1023

mapup-os-tasks-os-waiting-output -handler-path1, 1062 -handler-path2, 1069 -handler-path3, 1073 -handler-path4, 1076

mapup-os-tasks-tm-fetch-execute, 391 mapup-os-tm-post-interrupt, 1104 mapup-queue, 79, 80, 82–84, 364,

369–372, 375, 377, 391, 415, 416, 425, 739, 743, 746, 750, 753, 757, 765, 769, 773, 781, 784, 792, 794, 806, 810, 815, 829, 834, 838, 854, 858, 868, 873, 892, 895, 901, 905, 912, 917–919, 924, 925, 930, 937, 943–945, 951, 952, 957, 963, 969, 970, 974, 975, 980, 985, 986, 991, 992, 999, 1000, 1006, 1012, 1030, 1036, 1042, 1062, 1069, 1083, 1089, 1099– 1102 mapup-queue-getnth, 372 mapup-queue-getnth-for-ibuffers, 425 mapup-queue-getnth-for-obuffers, 975 mapup-queue-getnth2-os-mbuffers, 416 mapup-queue-list, 371, 372, 375 mapup-queue-list-putnth, 372 mapup-queue-os-readyq-os-clock-i nterrupt-handler, 892 mapup-queue-os-readyq-os-error-handler-path1, 895 handler-path2, 901

mapup-queue-os-readyq-os-runnin g-input-handler-path1, 1030 g-input-handler-path2, 1036 g-input-handler-path3, 1042 g-output-handler-path1, 1083 g-output-handler-path2, 1089 mapup-queue-os-readyq-os-svc-re ceive-handler-path1, 930 ceive-handler-path2, 937 ceive-handler-path3, 944 ceive-handler-path4, 952 mapup-queue-os-readyq-os-svc-se nd-handler-path1, 905 nd-handler-path2, 912 nd-handler-path3, 919 nd-handler-path4, 925 mapup-queue-os-readyq-os-svc-ty o-handler-path1, 974 o-handler-path2, 980 o-handler-path3, 986 o-handler-path4, 992 mapup-queue-os-readyq-os-svc-tyi -handler-path1, 957 -handler-path2, 963 -handler-path3, 970

mapup-queue-os-readyq-os-waitin g-input-handler-path1, 999 g-input-handler-path2, 1006 g-input-handler-path3, 1012 g-output-handler-path1, 1062 g-output-handler-path2, 1069

mapup-regs, 370, 371, 373, 374, 890, 893, 899, 903, 909, 915, 922, 928, 934, 940, 949, 955, 961, 967, 972, 978, 983, 989, 996, 1003, 1010, 1014, 1018, 1022, 1027, 1033, 1039, 1044, 1049, 1053, 1060, 1067, 1072, 1075, 1080, 1086, 1092, 1096

mapup-regs-os-clock-interrupt-h

andler, 890 mapup-regs-os-error-handler-pat

h1, 893 h2, 899

mapup-regs-os-running-input-han dler-path1, 1026 dler-path2, 1032 dler-path3, 1038 dler-path4, 1044 dler-path5, 1049 dler-path6, 1053

mapup-regs-os-running-output-ha ndler-path1, 1080 ndler-path2, 1086 ndler-path3, 1091 ndler-path4, 1096

mapup-regs-os-svc-receive-handle r-path1, 928 r-path2, 934 r-path3, 940 r-path4, 949

mapup-regs-os-svc-send-handler-p ath1, 903 ath2, 909 ath3, 915 ath4, 922 mapup-regs-os-svc-tyi-handler-p

ath1, 955 ath2, 961 ath3, 967

mapup-regs-os-svc-tyo-handler-p ath1, 972 ath2, 978 ath3, 983 ath4, 989

mapup-regs-os-waiting-input-han dler-path1, 996 dler-path2, 1003 dler-path3, 1010 dler-path4, 1014 dler-path5, 1018 dler-path6, 1022

mapup-regs-os-waiting-output-ha ndler-path1, 1060 ndler-path2, 1067 ndler-path3, 1072 ndler-path4, 1075

mapup-svcflag, 371, 374, 890, 894, 900, 904, 910, 916, 923, 929, 935, 941, 949, 956, 962, 967, 972, 979, 984, 989, 997, 1004, 1011, 1015, 1019, 1022, 1028, 1034, 1040, 1045, 1050, 1054, 1061, 1068, 1072, 1076, 1081, 1087, 1092, 1097 mapup-svcflag-os-clock-interrupt

-handler, 890 mapup-svcflag-os-error-handler-p

ath1, 894 ath2, 900

mapup-svcflag-os-running-input-handler-path1, 1027 handler-path2, 1033 handler-path3, 1039 handler-path4, 1045 handler-path5, 1049 handler-path6, 1054 mapup-svcflag-os-running-output -handler-path1, 1081 -handler-path2, 1087 -handler-path3, 1092 -handler-path4, 1096

mapup-svcflag-os-svc-receive-ha ndler-path1, 929 ndler-path2, 935 ndler-path3, 941 ndler-path4, 949

mapup-svcflag-os-svc-send-handle r-path1, 904 r-path2, 910 r-path3, 916 r-path4, 923

mapup-svcflag-os-svc-tyi-handle r-path1, 956 r-path2, 962 r-path3, 967

mapup-svcflag-os-svc-tyo-handle r-path1, 972 r-path2, 979 r-path3, 984 r-path4, 989

mapup-svcflag-os-waiting-input-handler-path1, 997 handler-path2, 1004 handler-path3, 1011 handler-path4, 1015 handler-path5, 1019 handler-path6, 1022

mapup-svcflag-os-waiting-output -handler-path1, 1061 -handler-path2, 1068 -handler-path3, 1072 -handler-path4, 1076

mapup-svcid, 371, 374, 890, 894, 900, 904, 910, 914–916, 921–923, 929, 935, 939–941, 948, 950, 956, 962, 966, 967, 973, 979, 982–984, 988–990, 997, 1004, 1011, 1015, 1019, 1023, 1028, 1034, 1040, 1045, 1050, 1054, 1061, 1068, 1072, 1076, 1081, 1087, 1092, 1097

mapup-svcid-os-clock-interrupt-handler, 890 mapup-svcid-os-error-handler-pat

h1, 894 h2, 900

mapup-svcid-os-running-input-ha ndler-path1, 1028 ndler-path2, 1034 ndler-path3, 1040 ndler-path4, 1045 ndler-path5, 1050 ndler-path6, 1054

mapup-svcid-os-running-output-h andler-path1, 1081 andler-path2, 1087 andler-path3, 1092 andler-path4, 1097

mapup-svcid-os-svc-receive-hand ler-path1, 929 ler-path2, 935 ler-path3, 941 ler-path4, 950

mapup-svcid-os-svc-send-handler -path1, 904 -path2, 910 -path3, 916 -path4, 923

mapup-svcid-os-svc-tyi-handler-p ath1, 956 ath2, 962 ath3, 967

mapup-svcid-os-svc-tyo-handler-p ath1, 973 ath2, 979 ath3, 984 ath4, 990

mapup-svcid-os-waiting-input-ha ndler-path1, 997 ndler-path2, 1004 ndler-path3, 1011 ndler-path4, 1015 ndler-path5, 1019 ndler-path6, 1023

mapup-svcid-os-waiting-output-h andler-path1, 1061 andler-path2, 1068 andler-path3, 1072 andler-path4, 1076

mapup-task, 371, 375, 390, 391, 891, 894, 900, 904, 911, 916, 923, 929, 936, 942, 950, 956, 962, 968, 973, 979, 984, 990, 997, 1004, 1011, 1015, 1019, 1023, 1028, 1034, 1040, 1046, 1050, 1055, 1061, 1068, 1072, 1076, 1082, 1087, 1093, 1097, 1099, 1100, 1102, 1104

mapup-task-os-clock-interrupt-h

andler, 890 mapup-task-os-error-handler-pat

h1, 894 h2, 900

mapup-task-os-running-input-han dler-path1, 1028 dler-path2, 1034 dler-path3, 1040 dler-path4, 1045 dler-path5, 1050 dler-path6, 1054

mapup-task-os-running-output-ha ndler-path1, 1081 ndler-path2, 1087 ndler-path3, 1093 ndler-path4, 1097

mapup-task-os-svc-receive-handle r-path1, 929 r-path2, 935 r-path3, 942 r-path4, 950

mapup-task-os-svc-send-handler-p ath1, 904 ath2, 910 ath3, 916 ath4, 923

mapup-task-os-svc-tyi-handler-p ath1, 956 ath2, 962 ath3, 968

mapup-task-os-svc-tyo-handler-p ath1, 973 ath2, 979 ath3, 984 ath4, 990

mapup-task-os-waiting-input-han dler-path1, 997 dler-path2, 1004 dler-path3, 1011 dler-path4, 1015 dler-path5, 1019 dler-path6, 1023

mapup-task-os-waiting-output-ha ndler-path1, 1061 ndler-path2, 1068 ndler-path3, 1072 ndler-path4, 1076 mapup-task-separation, 390 mapup-task-tm-fetch-execute-case

split, 390 mapup-task-tm-post-interrupt, 1104 mapup-tasks, 371, 373, 375, 390, 391,

891, 894, 901, 904, 911, 916, 917, 923, 924, 929, 936, 942, 943, 950, 951, 956, 963, 968, 973, 979, 984, 985, 990, 998, 1005, 1011, 1015, 1019, 1023, 1029, 1035, 1041, 1046, 1050, 1055, 1061, 1068, 1073, 1076, 1082, 1088, 1093, 1097, 1100, 1104

mapup-tasks-os-clock-interrupt-

handler, 891 mapup-tasks-os-error-handler-pat

h1, 894 h2, 900

mapup-tasks-os-running-input-ha ndler-path1, 1028 ndler-path2, 1034 ndler-path3, 1040 ndler-path4, 1046 ndler-path5, 1050 ndler-path6, 1055

mapup-tasks-os-running-output-h andler-path1, 1082 andler-path2, 1087 andler-path3, 1093 andler-path4, 1097

mapup-tasks-os-svc-receive-hand ler-path1, 929 ler-path2, 936 ler-path3-case1, 942 ler-path3-case2, 942 ler-path4-case1, 950 ler-path4-case2, 950

mapup-tasks-os-svc-send-handler -path1, 904 -path2, 911 -path3-case1, 916 -path3-case2, 917 -path4-case1, 923 -path4-case2, 924

mapup-tasks-os-svc-tyi-handler-p ath1, 956 ath2, 962 ath3-case1, 968 ath3-case2, 968

mapup-tasks-os-svc-tyo-handler-p ath1, 973 ath2, 979 ath3-case1, 984 ath3-case2, 985 ath4-case1, 990 ath4-case2, 990

mapup-tasks-os-waiting-input-ha ndler-path1, 998 ndler-path2, 1005 ndler-path3, 1011 ndler-path4, 1015 ndler-path5, 1019 ndler-path6, 1023

mapup-tasks-os-waiting-output-h andler-path1, 1061 andler-path2, 1068 andler-path3, 1073 andler-path4, 1076

mapup-tasks-tm-fetch-execute-ca se1, 390 se2, 391

mapup-tasks-tm-post-interrupt, 1104 member-insert, 25 member-permutation, 25 member-permutation2, 26 member-qfirst-queue, 66 member-remove1, 25 member-remove2, 25 memory-reference, 395 min, 20, 102, 103, 131, 195, 208, 213 min-memlength-tm-memlength-in-g ood-address-space, 213 min-tm-memlength-memlength-in-g ood-address-space, 208 more-ibuffer-address-facts, 421 mutually-disjoint, 194, 363, 386 mutually-disjoint-os-segment-ta

ble, 363 mutually-disjoint-segments-are-

disjoint, 386

disjoint-case1, 386

nested-intervals, 45–47, 379 non-1-finite-number-is-zero, 49 non-number-memlength-gives-bad-

address-space, 205 non-zero-difference, 16 non-zero-length-implies-listp, 29 non-zero-listp, 49, 50, 52, 53 non-zero-listp-append, 52 non-zero-listp-fixlength, 53 non-zero-listp-getseg, 52 non-zero-listp-list, 52 non-zero-listp-putnth, 52 non-zero-listp-putseg, 52 nonlast, 62–64, 83 nonlast-append, 63 nonlast-of-length-1, 83 not-ak-waiting-to-inputp-mapup-

os, 1017 not-ak-waiting-to-outputp-mapup

-os, 1074 not-ak-waiting-to-receivep-mapup

-os, 926 not-ak-waiting-to-sendp-mapup-o

s, 953 not-array-qemptyp-array-enq, 72 not-array-qemptyp-os-clock-new-

readyq, 738 not-array-qfullp-array-deq, 72 not-array-qfullp-array-nonlast, 77 not-equal-number-of-ready-tasks

-length-status, 300 not-equal-plus-base-limit-0, 378 not-lessp-plus-times-quotient, 22 not-lessp-times-plus, 21 not-lessp-times-plus-instance, 22 not-listp-remove, 24 not-member-index-ready-set, 298 not-member-insert, 25 not-member-permutation, 25 not-member-remove1, 25 not-member-remove2, 25 not-permutation, 26 not-qemptyp-enq, 65 not-qemptyp-mapup-queue-os-read

yq, 377 not-qfullp-deq, 65 not-status-flag-readyp-list, 299 not-tm-in-supervisor-mode-getnt

h-mapup-os-tasks, 1102 not-tm-in-supervisor-mode-mapup

-task, 1102 not-tm-in-supervisor-mode-os-cl

ock-interrupt-handler, 737 not-tm-in-supervisor-mode-os-er

ror-handler-path1, 741 ror-handler-path2, 744

not-tm-in-supervisor-mode-os-ru nning-input-handler-path1, 827 nning-input-handler-path2, 831 nning-input-handler-path3, 836 nning-input-handler-path4, 841 nning-input-handler-path5, 844 nning-input-handler-path6, 848 nning-output-handler-path1, 867 nning-output-handler-path2, 871 nning-output-handler-path3, 875 nning-output-handler-path4, 878

not-tm-in-supervisor-mode-os-sv c-receive-handler-path1, 764 c-receive-handler-path2, 767 c-receive-handler-path3, 771 c-receive-handler-path4, 776 c-send-handler-path1, 748 c-send-handler-path2, 751 c-send-handler-path3, 755 c-send-handler-path4, 760 c-tyi-handler-path1, 780 c-tyi-handler-path2, 783 c-tyi-handler-path3, 786 c-tyo-handler-path1, 790 c-tyo-handler-path2, 793 c-tyo-handler-path3, 797 c-tyo-handler-path4, 800

not-tm-in-supervisor-mode-os-waiti ng-input-handler-path1, 804 ng-input-handler-path2, 808 ng-input-handler-path3, 813 ng-input-handler-path4, 817 ng-input-handler-path5, 820 ng-input-handler-path6, 823 ng-output-handler-path1, 852 ng-output-handler-path2, 856 ng-output-handler-path3, 860 ng-output-handler-path4, 863

not-tm-waiting-os-clock-interrupt

-handler, 740 not-tm-waiting-os-error-handler

-path2, 747 not-tm-waiting-os-running-input

-handler-path1, 829 -handler-path2, 834 -handler-path3, 838 -handler-path4, 842 -handler-path5, 846 -handler-path6, 849

not-tm-waiting-os-running-output -handler-path1, 869 -handler-path2, 873 -handler-path3, 876 -handler-path4, 880

not-tm-waiting-os-svc-receive-h andler-path2, 769 andler-path3, 773 andler-path4, 777

not-tm-waiting-os-svc-send-hand ler-path2, 754 ler-path3, 757 ler-path4, 761

not-tm-waiting-os-svc-tyi-handle r-path2, 785 r-path3, 788

not-tm-waiting-os-svc-tyo-handle r-path2, 795 r-path3, 798 r-path4, 801

not-tm-waiting-os-waiting-input -handler-path1, 806 -handler-path2, 810 -handler-path3, 815

not-tm-waiting-os-waiting-output -handler-path1, 854 -handler-path2, 858

nthcdr, 29, 37, 53–61, 346, 347, 356,

376 nthcdr-append-left, 55 nthcdr-append-right, 55 nthcdr-for-length, 57 nthcdr-n-times, 346, 347 nthcdr-nthcdr, 59 nthcdr-putnth, 59 nthcdr-putseg, 59 nthcdr-with-large-n, 54 nthcdr-with-small-recursion, 347 nthcdr-zero, 54 number-and-list-induction, 12 number-and-litatom-listp, 318 number-listp, 49, 50, 62, 66, 299 number-listp-finite-number-listp, 62 number-of-occurrences-of-set-me

mber-is-1, 24 number-of-ready-tasks, 300–302, 369 number-of-ready-tasks-equals-le

ngth-ak-readyq, 302 ngth-index-ready-set, 301 ngth-os-readyq, 369

number-of-unready-tasks, 300 number-of-unready-tasks-non-zer

o, 300 numberp-alu-value-tm-alu-decr, 86 numberp-alu-value-tm-alu-decr-m

od, 87 numberp-alu-value-tm-alu-incr, 87 numberp-alu-value-tm-alu-incr-m

od, 88 numberp-alu-value-tm-alu-mod, 88 numberp-alu-value-tm-alu-mult, 89 numberp-alu-value-tm-alu-plus, 90 numberp-casesplit, 43 numberp-getnth, 50 numberp-getnth-from-tm-memory, 120 numberp-getnth-from-tm-regs, 121 numberp-mapup-base, 373 numberp-mapup-limit, 373 numberp-os-current-taskid, 386 numberp-qcurrlength, 68 numberp-qfirst, 66 numberp-qhead, 68 numberp-qmaxlength, 69 numberp-qtail, 68 numberp-tm-fix-reg-address, 118 numberp-tm-fix-word, 117

obuffer-address-facts, 429 occurrences, 23, 24 open-putnth-casesplit, 36 open-up-finite-number-listp, 129 open-up-getnth, 34 open-up-getnth-on-zero, 34 open-up-getnth1, 34 open-up-putnth-on-zero, 37 open-up-putnth1, 36 open-up-putseg-on-segment-cons, 44 open-up-tm-processor, 116 os-cih-time1, 446, 447 os-cih-time2, 446, 447 os-clock-interrupt-handler, 446, 447,

737–740, 883, 887, 889–892 os-clock-interrupt-handler-addre

ss, 346 os-clock-interrupt-handler-thru

-save-state, 440, 442, 447 os-clock-interrupt-handler-to-di

spatcher, 442, 444, 447 os-clock-interrupt-handler-to-re

store-state, 444, 446 os-clock-new-pc, 362 os-clock-new-readyq, 444, 738, 739,

889 os-code, 348, 352, 360, 393, 438, 448,

461, 533, 553, 673, 737, 740, 744, 748, 751, 755, 759, 763, 766, 770, 775, 779, 782, 786, 790, 792, 796, 799, 803, 807, 812, 817, 820, 823, 826, 831, 835, 840, 843, 847, 851, 855, 860, 862, 866, 870, 875, 878

os-code-address, 346 os-code-length, 346 os-code-os, 360 os-code-os-clock-interrupt-hand

ler, 737 os-code-os-error-handler-path1, 740 os-code-os-error-handler-path2, 744 os-code-os-running-input-handle

r-path1, 826 r-path2, 831 r-path3, 835 r-path4, 840 r-path5, 843 r-path6, 847

os-code-os-running-output-handle r-path1, 866 r-path2, 870 r-path3, 875 r-path4, 878

os-code-os-svc-receive-handler-p ath1, 763 ath2, 766 ath3, 770 ath4, 775

os-code-os-svc-send-handler-pat h1, 748 h2, 751 h3, 755

h4, 759 os-code-os-svc-tyi-handler-path

1, 779 2, 782 3, 786

os-code-os-svc-tyo-handler-path 1, 790 2, 792 3, 796 4, 799

os-code-os-waiting-input-handle r-path1, 803 r-path2, 807 r-path3, 812 r-path4, 817 r-path5, 820 r-path6, 823

os-code-os-waiting-output-handle r-path1, 851 r-path2, 855 r-path3, 860 r-path4, 862

os-current-ibuffer, 418, 422, 423, 539, 546, 549, 550, 552, 585, 588, 591, 600, 602, 603, 608, 611, 613, 621, 623–625, 633, 636, 639, 647, 648, 650, 655, 658, 661, 668, 670–672, 779, 782, 785, 787, 789, 803, 804, 807, 809, 811, 812, 814, 816, 818, 819, 821, 822, 824–826, 828, 830, 832, 835, 837, 839–841, 843, 845–847, 849, 850, 958, 964–969, 971, 998, 1000, 1005, 1007, 1012, 1013, 1016, 1017, 1020, 1021, 1023, 1025, 1029, 1031, 1035, 1037, 1041, 1043, 1046, 1047, 1051, 1052, 1055, 1056

os-current-mbuffer, 407, 413–415, 435, 468, 475, 488, 490, 492, 494, 496, 497, 503, 510, 523, 524, 526, 529, 531, 532, 747, 750, 751, 754, 757–759, 762, 763, 766, 770, 772–775, 778, 906, 913, 918, 920, 925, 927, 931, 938–940, 942–944, 946–952, 954

os-current-mbuffer-rewrite-to-get

nth2, 416 os-current-obuffer, 427, 429–431, 560,

566, 572, 573, 575–577, 680, 682, 691, 694, 699, 701–704, 711, 714, 723, 725, 730, 732, 734–736, 789, 792, 795–797, 799, 802, 851, 855, 857, 859, 862, 864–866, 869, 870, 872, 874, 877, 879, 881, 975, 981, 986, 987, 991, 993, 1064, 1069–1071, 1074, 1077, 1078, 1084, 1088, 1090, 1094, 1098, 1099

os-current-taskid, 357, 363, 370, 386, 388, 390, 391, 415, 423, 431, 433–435, 468, 475, 477, 483, 485, 488, 489, 492, 494, 496, 497, 503, 510, 512, 517, 519, 522, 524, 526, 527, 529, 531, 532, 539, 546, 549, 550, 552, 560, 566, 572, 573, 575–577, 740, 746, 747, 750, 751, 754, 755, 757–759, 762, 763, 766, 769–771, 773–775, 778, 779, 782, 785, 787–789, 792, 795– 799, 801, 802, 806, 807, 811, 816, 830, 834, 839, 842, 843, 846, 850, 854, 859, 869, 874, 877, 880, 889, 898, 899, 906, 909, 913, 918, 920, 925–927, 931, 933, 934, 938–940, 942– 944, 946–954, 958, 960, 961, 964–969, 971, 975, 977, 978, 981, 986, 987, 991, 993, 996, 1003, 1010, 1026, 1032, 1038, 1044, 1048, 1053, 1060, 1067, 1079, 1085, 1091, 1095

os-current-taskid-address, 350 os-current-taskid-tm-fetch-exec

ute, 388 os-destid, 273, 274, 280, 468, 475,

477, 480, 482, 485, 488, 490, 492, 494, 496, 497, 747, 749– 751, 753–759, 762, 905, 906, 912, 913, 917–920, 925–927

os-dispatcher-address, 352 os-dispatcher-pc-after-wait, 352 os-dispatcher-qemptyp-return-ad

dress, 352 os-dispatcher-return-address, 346 os-dispatcher-trace-label1, 352 os-dispatcher-trace-label2, 352 os-error-handler, 460, 747, 883, 902 os-error-handler-address, 346 os-error-handler-path1, 454, 458, 460, 740–743, 893–896 os-error-handler-path2, 457, 460, 744–

747, 896–902 os-error-handler-thru-save-state, 450, 452, 458, 459 os-error-handler-to-dispatcher, 452, 454, 455, 459

os-error-handler-to-restore-state, 455,

457 os-error-new-pc, 362 os-error-time1, 457, 458 os-error-time2, 458, 459 os-error-time3, 459 os-ibuffer-length, 331 os-ibuffers, 348, 349, 364, 372, 387,

418, 420–425, 433, 434, 533, 738, 742, 745, 749, 752, 756, 761, 765, 768, 772, 777, 780, 783, 787, 791, 794, 797, 800, 804, 805, 809, 813, 814, 818, 821, 824, 828, 832, 837, 841, 845, 848, 849, 852, 857, 861, 864, 867, 871, 876, 879

os-ibuffers-address, 346

os-ibuffers-address-plus-qarray

-field, 418 os-ibuffers-address-plus-qcurrle

ngth-field, 418 os-ibuffers-address-plus-qmaxle

ngth-field, 418 os-ibuffers-address-plus-qtail-

field, 418 os-ibuffers-length, 331 os-ibuffers-os-clock-interrupt-

handler, 738 os-ibuffers-os-error-handler-pat

h1, 742 h2, 745

os-ibuffers-os-running-input-ha ndler-path1, 828 ndler-path2, 832 ndler-path3, 837 ndler-path4, 841 ndler-path5, 845 ndler-path6, 848

os-ibuffers-os-running-output-h andler-path1, 867 andler-path2, 871 andler-path3, 876 andler-path4, 879

os-ibuffers-os-svc-receive-hand ler-path1, 765 ler-path2, 768 ler-path3, 772 ler-path4, 777

os-ibuffers-os-svc-send-handler -path1, 749 -path2, 752 -path3, 756 -path4, 761

os-ibuffers-os-svc-tyi-handler-p ath1, 780 ath2, 783 ath3, 787

os-ibuffers-os-svc-tyo-handler-p ath1, 791 ath2, 794 ath3, 797 ath4, 800

os-ibuffers-os-waiting-input-ha ndler-path1, 804 ndler-path2, 809 ndler-path3, 813 ndler-path4, 818 ndler-path5, 821 ndler-path6, 824 os-ibuffers-os-waiting-output-h andler-path1, 852 andler-path2, 857 andler-path3, 861 andler-path4, 864

os-ibuffers-tm-fetch-execute, 387 os-ibuffers-with-dequeued-chara cter, 423, 424, 787 os-ibuffers-with-enqueued-chara

cter, 425, 813, 824, 837, 848 os-ibuffers-with-enqueued-overf

low-character, 424, 425, 809, 821,

832, 845 os-ibuffers-with-qreplaced-over

flow-character, 424, 804, 818,

828, 841 os-idevid, 273, 274, 280 os-implements-ak, 1104 os-implements-parallel-tasks, 1105 os-input-interrupt-handler, 882, 883,

1101 os-input-interrupt-handler-addre

ss, 346 os-input-new-pc, 362 os-intended-clock-interrupt, 438–440,

447, 736 os-intended-error-interrupt, 447, 448, 450, 458–460, 740 os-intended-input-interrupt, 578, 580,

599–603, 621–625, 628, 646– 650, 667–671, 673, 802, 883

os-intended-output-interrupt, 673–675, 698–704, 706, 730–736, 850, 883

os-intended-svc-interrupt, 881, 882 os-intended-svc-receive-interrupt, 498,

522–525, 527–532, 763, 881 os-intended-svc-send-interrupt, 460,

461, 463, 487–498, 747, 881 os-intended-svc-tyi-interrupt, 533, 535,

548–553, 779, 881 os-intended-svc-tyo-interrupt, 553, 555,

571–577, 789, 881 os-limit, 348 os-machine-code, 347 os-mbuffer-dest-multiplier, 406 os-mbuffer-length, 331 os-mbuffer-source-multiplier, 406 os-mbuffers, 348, 350, 364, 372, 387,

407, 410–416, 435, 461, 739, 742, 745, 749, 752, 756, 761, 765, 768, 772, 777, 781, 784, 788, 791, 794, 798, 801, 805, 809, 814, 818, 821, 825, 828, 833, 837, 842, 845, 849, 853, 857, 861, 864, 867, 872, 876, 880

os-mbuffers-address, 346 os-mbuffers-address-facts1, 408 os-mbuffers-address-facts3, 409 os-mbuffers-address-plus-qarray

-field, 407 os-mbuffers-address-plus-qcurrle

ngth-field, 407 os-mbuffers-address-plus-qmaxle

ngth-field, 407 os-mbuffers-address-plus-qtail-

field, 406 os-mbuffers-length, 331 os-mbuffers-length-is-divisible

-by-4, 331 os-mbuffers-length-quarter, 331 os-mbuffers-os-clock-interrupt-

handler, 739 os-mbuffers-os-error-handler-pat

h1, 742 h2, 745

os-mbuffers-os-running-input-ha ndler-path1, 828 ndler-path2, 833 ndler-path3, 837 ndler-path4, 842 ndler-path5, 845

ndler-path6, 849 os-mbuffers-os-running-output-h

andler-path1, 867 andler-path2, 872 andler-path3, 876 andler-path4, 880

os-mbuffers-os-svc-receive-hand ler-path1, 765 ler-path2, 768 ler-path3, 772 ler-path4, 777

os-mbuffers-os-svc-send-handler -path1, 749 -path2, 752 -path3, 756 -path4, 761

os-mbuffers-os-svc-tyi-handler-p ath1, 781 ath2, 784 ath3, 788

os-mbuffers-os-svc-tyo-handler-p ath1, 791 ath2, 794 ath3, 798 ath4, 801

os-mbuffers-os-waiting-input-ha ndler-path1, 805 ndler-path2, 809 ndler-path3, 814 ndler-path4, 818 ndler-path5, 821 ndler-path6, 825

os-mbuffers-os-waiting-output-h andler-path1, 853 andler-path2, 857 andler-path3, 861 andler-path4, 864

os-mbuffers-tm-fetch-execute, 387 os-mbuffers-with-dequeued-messa

ge, 415, 772, 773, 777 os-mbuffers-with-enqueued-messa

ge, 415, 756, 757, 761 os-message, 273, 274, 276, 280, 906,

913, 920, 927, 975, 981, 986,

987, 991, 993 os-new-base, 403, 739, 746, 753, 769,

784, 795 os-new-cc, 403 os-new-cpu, 403 os-new-error, 403 os-new-flags, 403 os-new-limit, 403, 739, 746, 753, 769,

785, 795 os-new-regs, 403 os-new-svcflag, 403 os-new-svcid, 403 os-new-task-table, 403, 404, 738, 741,

745, 748, 752, 756, 760, 764, 767, 780, 783, 790, 793, 797, 800, 827, 832, 836, 841, 844, 848, 867, 871, 875, 878

os-not-in-supervisor-mode, 362 os-obuffer-length, 331 os-obuffers, 348, 350, 364, 372, 387,

427, 429–431, 553, 673, 739, 742, 745, 749, 752, 756, 761, 765, 768, 772, 777, 781, 784, 788, 791, 794, 797, 801, 805, 809, 814, 818, 821, 824, 828, 833, 837, 842, 845, 849, 853, 857, 861, 864, 867, 871, 872, 876, 879, 975

os-obuffers-address, 346 os-obuffers-address-plus-qarray

-field, 427 os-obuffers-address-plus-qcurrle

ngth-field, 427 os-obuffers-address-plus-qmaxle

ngth-field, 427 os-obuffers-address-plus-qtail-

field, 427 os-obuffers-length, 331 os-obuffers-os-clock-interrupt-

handler, 739 os-obuffers-os-error-handler-pat

h1, 742 h2, 745

os-obuffers-os-running-input-ha ndler-path1, 828 ndler-path2, 833 ndler-path3, 837 ndler-path4, 842 ndler-path5, 845 ndler-path6, 849

os-obuffers-os-running-output-h andler-path1, 867 andler-path2, 871 andler-path3, 876 andler-path4, 879

os-obuffers-os-svc-receive-hand ler-path1, 765 ler-path2, 768 ler-path3, 772 ler-path4, 777

os-obuffers-os-svc-send-handler -path1, 749 -path2, 752 -path3, 756 -path4, 761

os-obuffers-os-svc-tyi-handler-p ath1, 781 ath2, 784 ath3, 788

os-obuffers-os-svc-tyo-handler-p ath1, 791 ath2, 794 ath3, 797 ath4, 801

os-obuffers-os-waiting-input-ha ndler-path1, 805 ndler-path2, 809 ndler-path3, 814 ndler-path4, 818 ndler-path5, 821 ndler-path6, 824

os-obuffers-os-waiting-output-h andler-path1, 853 andler-path2, 857 andler-path3, 861 andler-path4, 864

os-obuffers-tm-fetch-execute, 387 os-obuffers-with-dequeued-chara

cter, 431, 857, 864, 871, 879 os-obuffers-with-enqueued-chara

cter, 431, 797, 798, 801 os-odevid, 273, 274, 280 os-oracle, 885, 887, 1105 os-oracle-step, 885 os-output-interrupt-handler, 883, 1101 os-output-interrupt-handler-add

ress, 346 os-output-new-pc, 362 os-pc-after-wait, 352 os-processor, 884, 886, 887, 1104 os-ready-set, 357, 364, 369, 377, 739,

743, 746, 750, 753, 757, 761, 765, 768, 769, 773, 777, 781, 784, 791, 792, 794, 805, 806, 810, 815, 829, 833, 834, 838, 853, 854, 858, 868, 872, 873

os-ready-set-os-clock-interrupt

-handler, 739 os-ready-set-os-error-handler-p

ath1, 743 ath2, 746

os-ready-set-os-running-input-h andler-path1, 829 andler-path2, 833 andler-path3, 838

os-ready-set-os-running-output-handler-path1, 868 handler-path2, 872

os-ready-set-os-svc-receive-han dler-path1, 765 dler-path2, 768 dler-path3, 773 dler-path4, 777

os-ready-set-os-svc-send-handle r-path1, 750 r-path2, 753 r-path3, 757 r-path4, 761

os-ready-set-os-svc-tyi-handler -path1, 781 -path2, 784

os-ready-set-os-svc-tyo-handler -path1, 791 -path2, 794

os-ready-set-os-waiting-input-h andler-path1, 805 andler-path2, 810 andler-path3, 814

os-ready-set-os-waiting-output-handler-path1, 853 handler-path2, 858

os-readyq, 348, 349, 357, 363–365, 369, 370, 372, 377, 379, 380, 387, 391, 403, 407, 408, 411, 413, 415, 432–436, 438, 444, 448, 454, 455, 457, 458, 460, 461, 470, 472, 488, 490, 497, 505, 507, 523, 524, 532, 533, 541, 543, 549, 550, 552, 553, 562, 564, 568, 570, 572, 573, 575–577, 673, 738, 740, 742– 747, 749–754, 756, 757, 761, 763–766, 768–770, 772, 773, 776, 779–785, 787, 789, 791, 792, 794–797, 799, 800, 802, 804, 806, 809, 810, 813, 815, 818, 821, 824, 826, 827, 829, 832, 834, 837, 838, 841, 845, 848, 851, 852, 854, 856, 858, 861, 863, 865, 867, 868, 871, 873, 876, 879, 889, 892, 895, 896, 898–902, 905, 906, 908– 919, 921–925, 930, 931, 933– 945, 947–952, 957, 958, 960– 970, 974, 975, 977–993, 999, 1006, 1012, 1030, 1036, 1042, 1062, 1069, 1083, 1089, 1099– 1102

os-readyq-address, 346 os-readyq-address-facts, 396 os-readyq-length, 331 os-readyq-os-clock-interrupt-ha

ndler, 738 os-readyq-os-error-handler-path

1, 742 2, 745 os-readyq-os-running-input-hand

ler-path1, 827 ler-path2, 832 ler-path3, 836 ler-path4, 841 ler-path5, 845 ler-path6, 848

os-readyq-os-running-output-han dler-path1, 867 dler-path2, 871 dler-path3, 876 dler-path4, 879

os-readyq-os-svc-receive-handle r-path1, 764 r-path2, 768 r-path3, 772 r-path4, 776

os-readyq-os-svc-send-handler-p ath1, 749 ath2, 752 ath3, 756 ath4, 761

os-readyq-os-svc-tyi-handler-pat h1, 780 h2, 783 h3, 787

os-readyq-os-svc-tyo-handler-pat h1, 791 h2, 794 h3, 797 h4, 800

os-readyq-os-waiting-input-hand ler-path1, 804 ler-path2, 809 ler-path3, 813 ler-path4, 818 ler-path5, 821 ler-path6, 824

os-readyq-os-waiting-output-han dler-path1, 852 dler-path2, 856 dler-path3, 861 dler-path4, 863

os-readyq-qarray, 357 os-readyq-qarray-address, 396 os-readyq-tm-fetch-execute, 387 os-restore-state-address, 352 os-resume-task-address, 352 os-resume-task-trace-label1, 352 os-running-input-handler, 672, 673, 850, 882, 1057 os-running-input-handler-path1, 641,

647, 672, 826–830, 1025– 1031

os-running-input-handler-path2, 643, 648, 672, 831–835, 1031– 1037

os-running-input-handler-path3, 645, 650, 672, 835–839, 1037– 1043

os-running-input-handler-path4, 663, 668, 672, 840–843, 1043– 1047

os-running-input-handler-path5, 665, 670, 672, 843–846, 1048– 1052

os-running-input-handler-path6, 667,

672, 847–850, 1052–1057 os-running-input-handler-thru-s

ave-state, 628, 630, 646, 648, 649, 653, 667–669, 671

os-running-input-handler-to-ibu

ffer-full-test, 630, 633, 636, 639,

646, 648, 650 ffer-full-test2, 653, 655, 658, 661,

668, 669, 671 os-running-input-handler-to-res ume-task1, 633, 641 ume-task2, 636, 643 ume-task3, 639, 645 ume-task4, 655, 663 ume-task5, 658, 665 ume-task6, 661, 666 os-running-input-time1, 645, 646 os-running-input-time10, 668, 669 os-running-input-time11, 670, 671 os-running-input-time12, 670, 671 os-running-input-time2, 645, 646 os-running-input-time3, 647, 648 os-running-input-time4, 647, 648 os-running-input-time5, 649 os-running-input-time6, 649, 650 os-running-input-time7, 667, 668 os-running-input-time8, 667, 668 os-running-input-time9, 668, 669 os-running-output-handler, 736, 881,

883, 1099 os-running-output-handler-path1, 716,

730, 736, 866–869, 1078– 1084

os-running-output-handler-path2, 718, 732, 736, 870–874, 1084– 1090

os-running-output-handler-path3, 727, 734, 736, 874–877, 1090– 1094

os-running-output-handler-path4, 729, 735, 736, 877–881, 1095– 1099

os-running-output-handler-thru-

save-state, 706, 709, 720, 730,

731, 733, 735 os-running-output-handler-to-ob

uffer-empty-test, 709, 711, 714,

730, 732 uffer-empty-test2, 720, 723, 725,

733, 735 os-running-output-handler-to-re

sume-task1, 711, 716 sume-task2, 714, 718 sume-task3, 723, 727 sume-task4, 725, 729

os-running-output-time1, 729, 730 os-running-output-time2, 729, 730 os-running-output-time3, 731 os-running-output-time4, 731, 732 os-running-output-time5, 732, 733 os-running-output-time6, 732, 733 os-running-output-time7, 734, 735 os-running-output-time8, 734, 735 os-save-state-return-address, 346 os-segment-lengths, 395 os-segment-table, 348, 349, 363, 364,

371, 379, 380, 386–388, 403, 404, 438, 448, 461, 533, 553, 673, 738, 740, 741, 745, 747, 749, 752, 754, 756, 758, 760, 762, 764, 767, 769, 772, 774, 776, 778, 780, 783, 785, 787, 788, 790, 793, 795, 797, 798, 800–802, 804, 806–808, 811, 813, 815–817, 821, 824, 827, 830, 832, 834, 836, 839, 841– 844, 846, 848, 850, 852, 854, 856, 858, 859, 861, 863, 867, 869, 871, 874, 875, 877, 879, 880

os-segment-table-address, 346 os-segment-table-address-facts, 404 os-segment-table-length, 331 os-segment-table-os-clock-inter rupt-handler, 738

os-segment-table-os-error-handle r-path1, 741 r-path2, 745

os-segment-table-os-running-inp ut-handler-path1, 827 ut-handler-path2, 832 ut-handler-path3, 836 ut-handler-path4, 841 ut-handler-path5, 844 ut-handler-path6, 848 os-segment-table-os-running-outp ut-handler-path1, 867 ut-handler-path2, 871 ut-handler-path3, 875 ut-handler-path4, 879 os-segment-table-os-svc-receive -handler-path1, 764 -handler-path2, 767 -handler-path3, 772 -handler-path4, 776 os-segment-table-os-svc-send-ha

ndler-path1, 749 ndler-path2, 752 ndler-path3, 756

ndler-path4, 760 os-segment-table-os-svc-tyi-han

dler-path1, 780 dler-path2, 783 dler-path3, 787

os-segment-table-os-svc-tyo-han dler-path1, 790 dler-path2, 793 dler-path3, 797 dler-path4, 800

os-segment-table-os-waiting-inp ut-handler-path1, 804 ut-handler-path2, 808 ut-handler-path3, 813 ut-handler-path4, 817 ut-handler-path5, 821 ut-handler-path6, 824

os-segment-table-os-waiting-outp ut-handler-path1, 852 ut-handler-path2, 856 ut-handler-path3, 861 ut-handler-path4, 863

os-segment-table-tm-fetch-execute, 388 os-source, 331 os-srcid, 273, 280, 415, 435, 503, 510,

512, 514, 517, 519, 522, 524, 526, 529, 531, 532, 763, 765, 766, 768, 770–775, 778, 930, 931, 937–940, 942–954

os-status-table, 348, 349, 357, 363, 369, 370, 372, 388, 405, 406, 448, 461, 477, 480, 482, 485, 492, 494, 496, 497, 512, 514, 517, 519, 526, 529, 531–533, 553, 582, 600, 602, 603, 605, 621, 623–625, 630, 641, 643, 645, 647, 648, 650, 652, 668, 670–673, 677, 689, 699, 701– 704, 709, 716, 718, 720, 730, 732, 734–736, 739, 742, 743, 745, 746, 749, 750, 753–755, 757–759, 761, 762, 765, 768, 770, 773–775, 777, 778, 781, 784, 788, 791, 794, 798, 801, 803, 805–807, 810–812, 814– 816, 819, 822, 825, 826, 828– 830, 833–835, 837–840, 842, 843, 845–847, 849–851, 853– 855, 857–859, 861, 862, 864– 866, 868–870, 872–874, 876, 877, 880, 881, 892, 895, 902, 905, 912, 917, 919, 920, 926, 927, 930, 937, 943–946, 953, 954, 957, 964, 970, 974, 980, 981, 986, 992, 999, 1000, 1006, 1007, 1013, 1017, 1021, 1024, 1026–1043, 1047, 1052, 1056, 1062–1064, 1070, 1074, 1078–1090, 1094, 1099

os-status-table-address, 346 os-status-table-address-facts, 405 os-status-table-length, 331 os-status-table-os-clock-interr

upt-handler, 739 os-status-table-os-error-handle

r-path1, 742 r-path2, 745

os-status-table-os-running-input -handler-path1, 828 -handler-path2, 833 -handler-path3, 837 -handler-path4, 842 -handler-path5, 845 -handler-path6, 849

os-status-table-os-running-outp ut-handler-path1, 868 ut-handler-path2, 872 ut-handler-path3, 876 ut-handler-path4, 880

os-status-table-os-svc-receive-handler-path1, 765 handler-path2, 768 handler-path3, 773 handler-path4, 777

os-status-table-os-svc-send-han dler-path1, 749 dler-path2, 753 dler-path3, 757

dler-path4, 761 os-status-table-os-svc-tyi-hand

ler-path1, 781 ler-path2, 784 ler-path3, 788

os-status-table-os-svc-tyo-hand ler-path1, 791 ler-path2, 794 ler-path3, 798 ler-path4, 801

os-status-table-os-waiting-input -handler-path1, 805 -handler-path2, 809 -handler-path3, 814 -handler-path4, 818 -handler-path5, 822 -handler-path6, 825

os-status-table-os-waiting-outp ut-handler-path1, 853 ut-handler-path2, 857 ut-handler-path3, 861 ut-handler-path4, 864

os-status-table-tm-fetch-execute, 388 os-step, 883, 884, 886, 1103 os-step-implements-ak-step, 1103 os-store-message, 273, 274, 276, 280,

942, 943, 946, 950, 951, 968, 969

os-svc-handler, 881–883, 1101 os-svc-handler-address, 346 os-svc-new-pc, 362 os-svc-receive-handler, 532, 779, 881,

954 os-svc-receive-handler-address, 350 os-svc-receive-handler-path1, 505, 523,

532, 763–766, 928–931 os-svc-receive-handler-path2, 507, 524,

532, 766–770, 931–938 os-svc-receive-handler-path3, 519, 527,

532, 770–775, 938–946 os-svc-receive-handler-path4, 521, 529,

531, 532, 775–778, 947–954 os-svc-receive-handler-thru-delive ry, 510, 512, 514, 517, 526, 528,

530 os-svc-receive-handler-thru-save

-state, 498, 501, 522, 524, 526,

528, 530 os-svc-receive-handler-to-dispat

cher, 503, 505, 507 os-svc-receive-handler-to-qempt

yp-test, 501, 503, 510, 522, 524,

526, 528, 530 os-svc-receive-handler-to-svc-re

sume-task1, 512, 519 sume-task2, 514, 521 sume-task3, 517, 521

os-svc-receive-id, 273 os-svc-receive-time1, 521, 522 os-svc-receive-time10, 527, 528 os-svc-receive-time11, 529, 530 os-svc-receive-time12, 529, 530 os-svc-receive-time13, 529, 530 os-svc-receive-time2, 521, 522 os-svc-receive-time3, 523, 524 os-svc-receive-time4, 523, 524 os-svc-receive-time5, 524–526 os-svc-receive-time6, 525, 526 os-svc-receive-time7, 525, 526 os-svc-receive-time8, 527, 528 os-svc-receive-time9, 527, 528 os-svc-resume-task-address, 352 os-svc-resume-task-trace-label1, 352 os-svc-send-handler, 497, 498, 763,

881, 927 os-svc-send-handler-path1, 470, 488,

497, 747–750, 903–906 os-svc-send-handler-path2, 472, 490,

497, 751–754, 907, 909–913 os-svc-send-handler-path3, 485, 492,

498, 755–759, 913–920 os-svc-send-handler-path4, 486, 487,

494, 496–498, 759–762, 920– 927

os-svc-send-handler-thru-enqueue, 475, 477, 480, 483, 491, 493, 494, 496 os-svc-send-handler-thru-save-st

ate, 463, 465, 487, 489, 491, 493,

495, 498 os-svc-send-handler-to-dispatche

r, 468, 470, 472 os-svc-send-handler-to-qfullp-te

st, 465, 468, 475, 488, 489, 491,

493, 495 os-svc-send-handler-to-svc-resu

me-task1, 477, 485 me-task2, 480, 486 me-task3, 483, 487

os-svc-send-id, 273 os-svc-send-time1, 487 os-svc-send-time10, 492, 493 os-svc-send-time11, 494, 495 os-svc-send-time12, 494, 495 os-svc-send-time13, 494–496 os-svc-send-time2, 487, 488 os-svc-send-time3, 488, 489 os-svc-send-time4, 488, 489 os-svc-send-time5, 490, 491 os-svc-send-time6, 490, 491 os-svc-send-time7, 490, 491 os-svc-send-time8, 492, 493 os-svc-send-time9, 492, 493 os-svc-tyi-handler, 552, 553, 789, 881,

971 os-svc-tyi-handler-address, 351 os-svc-tyi-handler-path1, 541, 549,

552, 779–782, 954–958 os-svc-tyi-handler-path2, 544, 551,

552, 782–785, 958–964 os-svc-tyi-handler-path3, 548, 552,

785–789, 965–971 os-svc-tyi-handler-thru-deliver

y, 546, 548 os-svc-tyi-handler-thru-save-st

ate, 535, 537, 548, 550, 552 os-svc-tyi-handler-to-dispatche

r, 539, 541, 543 os-svc-tyi-handler-to-qemptyp-te

st, 537, 539, 546, 549, 550, 552 os-svc-tyi-id, 273 os-svc-tyi-time1, 548 os-svc-tyi-time2, 548, 549 os-svc-tyi-time3, 549, 550 os-svc-tyi-time4, 549, 550 os-svc-tyi-time5, 551, 552 os-svc-tyi-time6, 551, 552 os-svc-tyo-handler, 577, 802, 881, 993 os-svc-tyo-handler-address, 351 os-svc-tyo-handler-path1, 562, 572, 577, 789–792, 971–975 os-svc-tyo-handler-path2, 564, 573, 577, 792–795, 975–981 os-svc-tyo-handler-path3, 568, 575, 577, 796–799, 981–987 os-svc-tyo-handler-path4, 570, 576, 577, 799–802, 987–993 os-svc-tyo-handler-thru-enqueue, 566,

568, 570 os-svc-tyo-handler-thru-save-st

ate, 555, 557, 571, 573, 574, 576 os-svc-tyo-handler-to-dispatche

r, 560, 562, 564 os-svc-tyo-handler-to-qfullp-te

st, 557, 560, 566, 571, 573, 574,

576 os-svc-tyo-id, 273 os-svc-tyo-time1, 570, 571 os-svc-tyo-time2, 571 os-svc-tyo-time3, 572, 573 os-svc-tyo-time4, 572, 573 os-svc-tyo-time5, 573, 574 os-svc-tyo-time6, 574 os-svc-tyo-time7, 575, 576 os-svc-tyo-time8, 575, 576 os-symtab, 342 os-task-table, 348, 363, 370, 388, 403,

432, 433, 435, 438, 448, 460, 533, 553, 673, 738, 741, 745, 748, 752, 756, 760, 764, 767, 771, 776, 780, 783, 786, 790, 793, 797, 800, 804, 808, 813, 817, 820, 823, 827, 832, 836, 841, 844, 848, 852, 856, 861, 863, 867, 871, 875, 878, 889, 898, 899, 909, 934, 960, 961, 977, 978, 996, 1003, 1010, 1026, 1032, 1038, 1044, 1048, 1053, 1060, 1067, 1079, 1085, 1091, 1095

os-task-table-address, 346 os-task-table-length, 331 os-task-table-os-clock-interrupt

-handler, 738 os-task-table-os-error-handler-p

ath1, 741 ath2, 745

os-task-table-os-running-input-handler-path1, 827 handler-path2, 832 handler-path3, 836 handler-path4, 841 handler-path5, 844 handler-path6, 848

os-task-table-os-running-output -handler-path1, 867 -handler-path2, 871 -handler-path3, 875 -handler-path4, 878

os-task-table-os-svc-receive-ha ndler-path1, 764 ndler-path2, 767 ndler-path3, 771 ndler-path4, 776

os-task-table-os-svc-send-handle r-path1, 748 r-path2, 752 r-path3, 756 r-path4, 760

os-task-table-os-svc-tyi-handle r-path1, 780 r-path2, 783 r-path3, 786

os-task-table-os-svc-tyo-handle r-path1, 790 r-path2, 793 r-path3, 797 r-path4, 800

os-task-table-os-waiting-input-handler-path1, 804 handler-path2, 808 handler-path3, 813 handler-path4, 817 handler-path5, 820 handler-path6, 823 os-task-table-os-waiting-output -handler-path1, 852 -handler-path2, 856 -handler-path3, 860 -handler-path4, 863

os-task-table-tm-fetch-execute, 388 os-task-table-with-delivered-ch aracter, 433, 434, 786, 787 os-task-table-with-delivered-me

ssage, 435, 436, 771, 772, 776 os-taskid, 365 os-temp-r2-address, 352 os-temp-r3-address, 352 os-time-for-clock-interrupt-han dler, 446, 447, 884, 885 dler-thru-save-state, 439, 440,

447 dler-to-dispatcher, 441, 442, 447 dler-to-finish, 444, 446, 447 dler-to-restore-state, 442, 444,

447 os-time-for-error-handler, 460, 884,

885 os-time-for-error-handler-path1, 458,

460 os-time-for-error-handler-path2, 459,

460 os-time-for-error-handler-thru-

save-state, 448, 450, 458, 459 os-time-for-error-handler-to-di

spatcher, 450, 452, 458, 459 os-time-for-error-handler-to-fi nish, 456, 457, 459 os-time-for-error-handler-to-re store-state, 454, 455, 459 os-time-for-error-handler-to-wait -state, 452, 454, 458 os-time-for-input-interrupt-han

dler, 882–885 os-time-for-output-interrupt-ha

ndler, 883–885 os-time-for-running-input-handle

r, 672, 673, 882 r-path1, 646, 647, 672 r-path2, 647, 648, 672 r-path3, 649, 650, 672 r-path4, 667, 668, 672 r-path5, 669, 670, 672 r-path6, 670–672 r-thru-save-state, 626, 628, 646,

648, 649, 667, 669, 671 r-to-ibuffer-full-test, 628, 630, 646,

648, 650 r-to-ibuffer-full-test2, 650, 653,

668, 669, 671 r-to-lpsw, 639, 641, 643, 645,

646, 648, 650, 663, 665, 667– 669, 671

r-to-resume-task1, 630, 633, 646 r-to-resume-task2, 633, 636, 648 r-to-resume-task3, 636, 639, 650 r-to-resume-task4, 653, 655, 668 r-to-resume-task5, 655, 658, 669 r-to-resume-task6, 658, 661, 671

os-time-for-running-output-hand ler, 735, 736, 883 ler-path1, 729, 730, 736 ler-path2, 731, 732, 736 ler-path3, 733, 734, 736 ler-path4, 734–736 ler-thru-save-state, 704, 706, 730,

731, 733, 735 ler-to-lpsw, 714, 716, 718, 727,

729, 730, 732, 733, 735 ler-to-obuffer-empty-test, 706, 707,

709, 730, 732 ler-to-obuffer-empty-test2, 718,

720, 733, 735 ler-to-resume-task1, 709, 711, 730 ler-to-resume-task2, 711, 714, 732 ler-to-resume-task3, 720, 721, 723,

733

ler-to-resume-task4, 723, 725, 735 os-time-for-svc-handler, 881, 882, 884,

885 os-time-for-svc-receive-handler, 532,

881 -path1, 522, 523, 532 -path2, 523, 524, 532 -path3, 525, 527, 532 -path4, 531, 532 -path4a, 527–529, 531 -path4b, 529–531 -thru-delivery, 507, 510, 526, 528,

530 -thru-save-state, 498, 522, 523,

525, 528, 530 -to-dispatcher, 501, 503, 522, 524 -to-lpsw, 505, 507, 524 -to-qemptyp-test, 498, 501, 522, 524, 526, 528, 530 -to-svc-resume-task1, 510, 512,

526 -to-svc-resume-task2, 512, 514,

528 -to-svc-resume-task3, 514, 517,

530 -to-svcr, 517, 519, 521, 526, 528,

530 -to-wait-state, 503, 505, 522 os-time-for-svc-send-handler, 497, 498,

881 os-time-for-svc-send-handler-pat

h1, 487, 488, 497 h2, 489, 490, 497 h3, 490–492, 497 h4, 496, 497 h4a, 493, 494, 496 h4b, 495, 496

os-time-for-svc-send-handler-th

ru-enqueue, 472, 475, 491, 493,

495 ru-save-state, 461, 463, 487, 489, 491, 493, 495, 498 os-time-for-svc-send-handler-to

-dispatcher, 465, 468, 488, 489 -lpsw, 470, 472, 489 -qfullp-test, 463, 465, 488, 489,

491, 493, 495 -svc-resume-task1, 475, 477, 491 -svc-resume-task2, 477, 480, 494 -svc-resume-task3, 480, 483, 496 -svcr, 483, 485–487, 491, 494,

496 -wait-state, 468, 470, 488

os-time-for-svc-tyi-handler, 552, 553,

881 os-time-for-svc-tyi-handler-pat

h1, 548, 549, 552 h2, 549–552 h3, 551, 552

os-time-for-svc-tyi-handler-thr u-delivery, 544, 546, 552 u-save-state, 533, 535, 548, 550,

551 os-time-for-svc-tyi-handler-to-

dispatcher, 537, 539, 549, 550 lpsw, 541, 544, 550 svcr, 546, 548, 552 wait-state, 539–541, 549

os-time-for-svc-tyi-handler-to-qe

mptyp-test, 535, 537, 548, 550,

552 os-time-for-svc-tyo-handler, 577, 881 os-time-for-svc-tyo-handler-pat

h1, 571, 572, 577 h2, 572, 573, 577 h3, 574, 575, 577 h4, 575–577

os-time-for-svc-tyo-handler-thr u-enqueue, 564, 566, 575, 576 u-save-state, 554, 555, 571, 573,

574, 576 os-time-for-svc-tyo-handler-to-

dispatcher, 558, 560, 571, 573 lpsw, 562, 564, 573 svcr1, 566, 568, 575 svcr2, 568, 570, 576 wait-state, 560, 562, 571

os-time-for-svc-tyo-handler-to-q fullp-test, 556, 557, 571, 573,

574, 576 os-time-for-waiting-input-handle

r, 624, 625, 882 r-path1, 599, 600, 625 r-path2, 600–602, 625 r-path3, 602, 603, 625 r-path4, 620, 621, 625 r-path5, 622, 623, 625 r-path6, 623–625 r-thru-readyq-empty-test, 578,

580, 599, 601, 603, 621–623 r-to-dispatcher1, 583, 585, 600 r-to-dispatcher2, 585, 588, 601 r-to-dispatcher3, 588, 591, 603 r-to-dispatcher4, 606, 608, 621 r-to-dispatcher5, 608, 611, 622 r-to-dispatcher6, 611, 613, 624 r-to-ibuffer-full-test, 580, 582, 599,

601, 603 r-to-ibuffer-full-test2, 604, 606,

621, 622, 624 r-to-lpsw, 591, 593, 596, 598,

600, 601, 603 r-to-wait, 613, 614, 616, 618,

620–622, 624 os-time-for-waiting-output-hand

ler, 704, 883 ler-path1, 698, 699, 704 ler-path2, 700, 701, 704 ler-path3, 701, 702, 704 ler-path4, 702–704 ler-thru-readyq-empty-test, 674,

675, 698, 700, 701, 703 ler-to-dispatcher1, 678, 680, 699 ler-to-dispatcher2, 680, 682, 700 ler-to-dispatcher3, 690, 691, 702 ler-to-dispatcher4, 692, 694, 703 ler-to-lpsw, 682, 685, 687, 699,

700 ler-to-obuffer-empty-test, 675, 678,

698, 700 ler-to-obuffer-empty-test2, 688,

689, 701, 703 ler-to-wait, 694, 696, 697, 702,

703 os-time-slice, 362 os-time-slice-address, 346 os-trace-label1, 350 os-trace-label10, 350 os-trace-label11, 350 os-trace-label12, 351 os-trace-label13, 351 os-trace-label14, 351 os-trace-label15, 351 os-trace-label16, 351 os-trace-label17, 351 os-trace-label18, 351 os-trace-label19, 351 os-trace-label2, 350 os-trace-label20, 351 os-trace-label21, 351 os-trace-label22, 351 os-trace-label23, 351 os-trace-label24, 351 os-trace-label25, 351 os-trace-label26, 351 os-trace-label27, 351 os-trace-label28, 351 os-trace-label29, 351 os-trace-label3, 350 os-trace-label30, 351 os-trace-label31, 351 os-trace-label32, 351 os-trace-label33, 351 os-trace-label34, 351 os-trace-label35, 352 os-trace-label36, 352 os-trace-label4, 350 os-trace-label5, 350 os-trace-label6, 350 os-trace-label7, 350 os-trace-label8, 350 os-trace-label9, 350 os-update-status, 406, 742, 743, 745,

746, 749, 753, 765, 768, 773, 781, 784, 791, 794, 805, 810, 814, 828, 833, 838, 853, 857, 868, 872

os-waiting-input-handler, 625, 825,

882, 1025 os-waiting-input-handler-path1, 593,

600, 625, 803–807, 993, 994, 996–1000

os-waiting-input-handler-path2, 596, 602, 625, 807–811, 1000, 1001, 1003–1007

os-waiting-input-handler-path3, 598, 603, 625, 812–816, 1007, 1010– 1014

os-waiting-input-handler-path4, 616, 621, 625, 816–819, 1014– 1017

os-waiting-input-handler-path5, 618, 623, 625, 819–822, 1018– 1021

os-waiting-input-handler-path6, 620, 624, 625, 822–825, 1021– 1025

os-waiting-input-handler-thru-re

adyq-empty-test, 580, 582, 599, 601, 603, 606, 621, 622, 624

os-waiting-input-handler-to-disp atcher1, 585, 593 atcher2, 588, 596 atcher3, 591, 598 atcher4, 608, 616 atcher5, 611, 618 atcher6, 613, 620 os-waiting-input-handler-to-ibu

ffer-full-test, 583, 585, 588, 591,

600, 601, 603 ffer-full-test2, 606, 608, 611, 613,

621, 622, 624 os-waiting-input-time1, 598, 599 os-waiting-input-time10, 622 os-waiting-input-time11, 623, 624 os-waiting-input-time12, 623, 624 os-waiting-input-time2, 599, 600 os-waiting-input-time3, 600, 601 os-waiting-input-time4, 600, 601 os-waiting-input-time5, 602, 603 os-waiting-input-time6, 602, 603 os-waiting-input-time7, 620, 621 os-waiting-input-time8, 620, 621 os-waiting-input-time9, 622 os-waiting-output-handler, 704, 865,

883, 1078 os-waiting-output-handler-path1, 685,

699, 704, 851–855, 1057, 1060– 1064

os-waiting-output-handler-path2, 687, 701, 704, 855–859, 1064, 1067– 1071

os-waiting-output-handler-path3, 696, 702, 704, 859–862, 1071– 1074

os-waiting-output-handler-path4, 698, 703, 704, 862–865, 1074– 1078

os-waiting-output-handler-thru-

readyq-empty-test, 675, 678, 689,

698, 700, 701, 703 os-waiting-output-handler-to-di

spatcher1, 680, 685 spatcher2, 682, 687 spatcher3, 691, 696 spatcher4, 694, 697

os-waiting-output-handler-to-ob

uffer-empty-test, 678, 680, 682,

699, 700 uffer-empty-test2, 689, 691, 694,

702, 703 os-waiting-output-time1, 698 os-waiting-output-time2, 698, 699 os-waiting-output-time3, 699, 700 os-waiting-output-time4, 699, 700 os-waiting-output-time5, 701 os-waiting-output-time6, 701, 702 os-waiting-output-time7, 702, 703 os-waiting-output-time8, 702, 703 os-waiting-to-inputp-implies-re

adyq-not-full, 370 os-waiting-to-outputp-implies-re

adyq-not-full, 370 os-waiting-to-receivep-implies-readyq-not-full, 369 os-waiting-to-sendp-implies-rea dyq-not-full, 369

permutation, 23–28, 51, 66, 298–300, 302, 364, 369, 370, 739, 743, 746, 750, 753, 757, 765, 769, 773, 781, 784, 792, 794, 806, 810, 815, 829, 834, 838, 854, 858, 868, 873 permutation-ak-readyq-ak-ready-

set, 298 permutation-append-car, 26 permutation-append-insert, 27 permutation-deq-index-ready-set

-putnth, 299 permutation-enq-deq, 66 permutation-enq-index-ready-set

-putnth, 302 permutation-os-clock-new-readyq

-os-ready-set, 739 permutation-os-readyq-os-ready-

set-for-os-error-handler-path1, 743 set-for-os-error-handler-path2, 746 set-for-os-running-input-handler-

path1, 829 set-for-os-running-input-handler-

path2, 833 set-for-os-running-input-handler-

path3, 838 set-for-os-running-output-handler-

path1, 868 set-for-os-running-output-handler-

path2, 873 set-for-os-svc-receive-handler-path1,

765 set-for-os-svc-receive-handler-path2,

769 set-for-os-svc-receive-handler-path3,

773 set-for-os-svc-send-handler-path1,

750 set-for-os-svc-send-handler-path2,

753 set-for-os-svc-send-handler-path3,

757 set-for-os-svc-tyi-handler-path1,

781 set-for-os-svc-tyi-handler-path2,

784 set-for-os-svc-tyo-handler-path1,

792 set-for-os-svc-tyo-handler-path2,

794 set-for-os-waiting-input-handler-

path1, 806 set-for-os-waiting-input-handler-

path2, 810 set-for-os-waiting-input-handler-

path3, 815 set-for-os-waiting-output-handler-

path1, 853 set-for-os-waiting-output-handler-

path2, 858 permutation-os-readyq-qarray-os

-ready-set, 364 -ready-set-corollary, 370

permutation-reflexivity, 26 permutation-remove-remove, 27 permutation-right-cons, 26 permutation-right-cons1, 26 plist-of-length-0, 31 plist-of-non-zero-length-is-a-li

st, 29 plistp, 23, 24, 28, 29, 31–34, 47–49,

53–57, 59–64, 68–71, 73, 77, 79, 80, 120, 121, 123, 126, 128–130, 133, 135, 150, 151, 159, 163, 206, 209, 276–279, 290, 291, 294–297, 299, 302, 304, 305, 328, 348–350, 352, 353, 355, 356, 365, 367–369, 373, 385, 397, 398, 415, 416, 424, 425, 431, 434, 435, 1104, 1105

plistp-address-space-memory, 206 plistp-address-space-regs, 206 plistp-ak-ibuffers, 294 plistp-ak-iports, 297 plistp-ak-mbuffers, 295 plistp-ak-obuffers, 295 plistp-ak-oports, 297 plistp-ak-readyq, 296 plistp-ak-status, 296 plistp-append, 31 plistp-array-deq, 71 plistp-array-enq, 70 plistp-array-nonlast, 73 plistp-array-qarray, 69 plistp-array-qreplace, 77 plistp-array-queue, 68 plistp-delta-segment, 79 plistp-deq, 64 plistp-enq, 64 plistp-finite-number-queue, 353 plistp-finite-number-queue-coro

llary, 365

llary-for-ibuffers, 416 llary-for-mbuffers, 367 llary-for-obuffers, 425

plistp-firstn, 53 plistp-fixlength, 32 plistp-flatten, 57 plistp-getnth-from-table, 56 plistp-getnth-table, 56 plistp-getseg, 32 plistp-good-address-space-list, 290 plistp-good-status-list, 291 plistp-good-task-buffer-list, 277 plistp-good-task-buffer-table, 279 plistp-list1, 31 plistp-list2, 31 plistp-mapup-queue, 80 plistp-mapup-regs, 373 plistp-nonlast, 63 plistp-nthcdr, 53 plistp-os-code, 352 plistp-os-ibuffers, 349 plistp-os-ibuffers-with-dequeue

d-character, 424 plistp-os-ibuffers-with-enqueue

d-character, 425

d-overflow-character, 425 plistp-os-ibuffers-with-qreplace

d-overflow-character, 424 plistp-os-mbuffers, 350 plistp-os-mbuffers-with-dequeue

d-message, 415 plistp-os-mbuffers-with-enqueue

d-message, 415 plistp-os-obuffers, 350 plistp-os-obuffers-with-dequeue

d-character, 431 plistp-os-obuffers-with-enqueue

d-character, 431 plistp-os-readyq, 349 plistp-os-segment-table, 349 plistp-os-status-table, 349 plistp-os-task-table, 348 plistp-os-task-table-with-delive

red-character, 434 red-message, 435

plistp-putnth, 32 plistp-putnth2, 47 plistp-putseg, 32 plistp-qreplace, 64 plistp-remove, 24 plistp-reverse, 48 plistp-set, 24 plistp-table, 55 plistp-tm-cpu, 129 plistp-tm-iports, 123 plistp-tm-memory, 120 plistp-tm-oports, 123 plistp-tm-regs, 121 plus-0, 13 plus-0-arg1, 13 plus-1, 13 plus-add1, 2 plus-arg2-must-be-zero, 45 plus-cancellation, 3 plus-commutativity-associativit

y-crock, 14 plus-difference-cancellation, 13 plus-equal-0, 2 plus-not-equal, 22 plus-plus-difference, 14 plus-right-id2, 2 plus-times-reduction, 14 plus-times-sub1-reduction, 14 plus-tm-base-tm-limit-tm-decreme

nt-clock, 160 plus-tm-base-tm-limit-tm-set-cc, 225 plus-tm-base-tm-limit-tm-set-pc, 160 plus-tm-base-tm-limit-tm-set-sp, 225 project, 312, 314, 317, 1105 project-ith-task, 1105 putnth, 28, 30, 32, 35–42, 44, 47, 51,

52, 59, 60, 70, 71, 73, 77, 80, 97, 100–102, 124, 129, 272, 278–280, 283–288, 290, 291, 299–302, 354–356, 369, 370, 372, 379, 380, 391–393, 398, 399, 404, 405, 413, 414, 422, 423, 430, 433–435, 438, 448, 461, 533, 553, 673, 750, 753, 757, 765, 768, 773, 781, 784, 791, 794, 805, 810, 815, 829, 833, 838, 853, 858, 868, 873, 895, 902, 905, 912, 914, 915, 917, 919, 921, 922, 924, 930, 937, 939, 940, 943, 945, 947–949, 951, 957, 964–969, 974, 981–983, 985, 988–991, 999, 1006, 1013, 1030, 1036, 1042, 1063, 1070, 1083, 1089

putnth-after-putseg, 40

putnth-after-putseg-proof, 40 putnth-append-casesplit, 37 putnth-append-left, 38 putnth-append-right, 38 putnth-coincidence, 38 putnth-cons1, 37 putnth-cons2, 37 putnth-getnth-coincidence, 38 putnth-getnth-coincidence1, 38 putnth-has-no-effect, 37 putnth-into-nil, 37 putnth-non-interference, 38 putnth-non-interference-corolla

ry1, 39 ry2, 39

putnth-nthcdr, 59 putnth-putnth-casesplit, 38 putnth-putseg-coincidence, 39 putnth-putseg-coincidence-inver

se, 39 putnth-putseg-coincidence-proof, 39 putnth-shift, 37 putnth-with-non-number-index, 37 putnth2, 47, 48, 84, 278, 356, 369 putseg, 28, 30–32, 36, 39, 40, 42–44,

51, 52, 59, 60, 399, 403– 406, 413–415, 422–425, 430– 433, 435, 438, 448, 461, 533, 553, 673, 757

putseg-cons1, 44 putseg-cons2, 43 putseg-getseg-coincidence, 44 putseg-has-no-effect, 43 putseg-nil-segment, 44 putseg-non-list-segment, 44 putseg-nthcdr, 59 putseg-nthcdr-proof, 59 putseg-with-non-number-index, 39

qarray-field, 66 qcurrlength-field, 66 qemptyp, 64–66, 82, 84, 275, 282,

286, 288, 289, 298–300, 305, 377

qemptyp2, 84, 274, 284, 304 qfirst, 64–66, 82, 84, 275, 279, 286,

288, 289, 299, 300, 377, 391, 892, 917, 918, 924, 925, 943, 944, 951, 952, 969, 985, 991, 1070, 1078, 1090, 1099, 1100, 1102

qfirst-enq, 65 qfirst2, 84, 274, 284 qfullp, 64, 65, 82, 84, 275, 285, 287,

302, 305, 415, 975, 1000 qfullp2, 84, 274, 283, 303 qhead-field, 66 qmaxlength-field, 66 qmaxlength-greater-than-zero, 69 qmaxlength-non-zero, 69 qreplace, 64–66, 84, 272 qreplace-address-fact, 420 qreplace-ith-buffer, 272, 287, 998, 1016,

1029, 1046 qtail-field, 66 queue-facts, 298 quotient-difference, 18 quotient-divides, 9 quotient-lessp, 8 quotient-plus, 18 quotient-plus-plus-plus-times, 389 quotient-plus-plus-times, 389 quotient-plus-times, 18 quotient-plus-times-remainder, 22 quotient-times, 9 quotient-times-other-way, 18 quotient-times1, 8 quotient-x-x, 17

re-associate-times, 406 re-associate-times1, 407 real-addr, 101–104, 106, 111, 112,

160, 208, 209, 214, 268, 269, 271

real-addr-num, 101–103, 132, 156, 218, 379, 380 real-addr-source, 101–103, 132, 156, 218, 379, 380

registers-untouched-by-tm-execute, 193 -add, 163 -binary, 191 -call, 167 -decr, 169 -decr-mod, 170 -incr, 171 -incr-mod, 171 -instruction, 192 -mod, 176 -multiply, 178 -nullary, 190 -return, 179 -unary, 190

registers-untouched-by-tm-fetch

-execute, 193 regroup-fact, 16 remainder-4-equals-3, 882 remainder-add1, 7 remainder-add1-casesplit, 17 remainder-array-qfirst-finite-n

umber-queue, 354 umber-queue-corollary, 366 umber-queue-corollary-for-ibuffers,

417 umber-queue-corollary-for-mbuffers,

368 umber-queue-corollary-for-obuffers,

427 remainder-difference-non-zero, 19 remainder-difference-times, 11 remainder-divides, 21 remainder-non-zero, 22 remainder-noop, 17 remainder-of-1, 11 remainder-plus, 20 remainder-plus-plus-plus-times, 389 remainder-plus-plus-times, 389 remainder-plus-times-1, 11 remainder-plus-times-2, 11 remainder-plus-times-remainder, 22 remainder-quotient, 5 remainder-quotient-elim, 5 remainder-remainder, 21 remainder-remainder-inverse, 23 remainder-times, 9 remainder-times-1, 11 remainder-times-other-way, 17 remainder-wrt-1, 5 remainder-wrt-12, 5 remainder-x-x, 5 remainder-zero-implies-leq-fact, 20 remove, 23–28, 51, 66, 299 remove-remove, 25 restore-cc, 432 restore-cc-for-receive-svc-retu

rn, 435 restore-cc-for-tyi-svc-return, 434 restore-error, 432 restore-error-for-receive-svc-ret

urn, 436 restore-error-for-tyi-svc-retur

n, 434 restore-regs, 432 restore-regs-for-receive-svc-ret

urn, 435 restore-regs-for-tyi-svc-return, 434 restore-regs1, 432 restore-svcflag, 433 restore-svcid, 433 restore-svcid-for-receive-svc-ret

urn, 436 restore-svcid-for-tyi-svc-retur

n, 434 reverse, 48, 49, 886, 1104 reverse-alist, 329 reverse-append, 48 reverse-list1, 48 reverse-list2, 48 reverse-reverse, 49 rewrite-car-to-getnth-0, 30 rewrite-clock-trace1, 447 rewrite-clock-trace2, 447 rewrite-clock-trace3, 447 rewrite-error-trace1, 458 rewrite-error-trace2, 458 rewrite-error-trace3, 459 rewrite-error-trace4, 459 rewrite-error-trace5, 459 rewrite-getnth-from-table, 58 rewrite-getnth-from-table0, 59 rewrite-insert-to-cons-crock, 301 rewrite-insert-to-cons-crock1, 301 rewrite-insert-to-cons-crock2, 301 rewrite-non-zero-difference-as-

lessp, 16 rewrite-os-mbuffer-address, 407 rewrite-os-mbuffer-address1, 408 rewrite-running-input-trace1, 646 rewrite-running-input-trace10, 667 rewrite-running-input-trace11, 667 rewrite-running-input-trace12, 668 rewrite-running-input-trace13, 669 rewrite-running-input-trace14, 669 rewrite-running-input-trace15, 669 rewrite-running-input-trace16, 671 rewrite-running-input-trace17, 671 rewrite-running-input-trace18, 671 rewrite-running-input-trace2, 646 rewrite-running-input-trace3, 646 rewrite-running-input-trace4, 648 rewrite-running-input-trace5, 648 rewrite-running-input-trace6, 648 rewrite-running-input-trace7, 649 rewrite-running-input-trace8, 649 rewrite-running-input-trace9, 650 rewrite-running-output-trace1, 730 rewrite-running-output-trace10, 734 rewrite-running-output-trace11, 735 rewrite-running-output-trace12, 735 rewrite-running-output-trace2, 730 rewrite-running-output-trace3, 730 rewrite-running-output-trace4, 731 rewrite-running-output-trace5, 731 rewrite-running-output-trace6, 732 rewrite-running-output-trace7, 733 rewrite-running-output-trace8, 733 rewrite-running-output-trace9, 733 rewrite-svc-receive-trace1, 522 rewrite-svc-receive-trace10, 526 rewrite-svc-receive-trace11, 528 rewrite-svc-receive-trace12, 528 rewrite-svc-receive-trace13, 528 rewrite-svc-receive-trace14, 528 rewrite-svc-receive-trace15, 530 rewrite-svc-receive-trace16, 530 rewrite-svc-receive-trace17, 530 rewrite-svc-receive-trace18, 530 rewrite-svc-receive-trace2, 522 rewrite-svc-receive-trace3, 522 rewrite-svc-receive-trace4, 523 rewrite-svc-receive-trace5, 524 rewrite-svc-receive-trace6, 524 rewrite-svc-receive-trace7, 525 rewrite-svc-receive-trace8, 526 rewrite-svc-receive-trace9, 526 rewrite-svc-send-trace1, 487 rewrite-svc-send-trace10, 491 rewrite-svc-send-trace11, 493 rewrite-svc-send-trace12, 493 rewrite-svc-send-trace13, 493 rewrite-svc-send-trace14, 493 rewrite-svc-send-trace15, 495 rewrite-svc-send-trace16, 495 rewrite-svc-send-trace17, 495 rewrite-svc-send-trace18, 496 rewrite-svc-send-trace2, 487 rewrite-svc-send-trace3, 488 rewrite-svc-send-trace4, 489 rewrite-svc-send-trace5, 489 rewrite-svc-send-trace6, 489 rewrite-svc-send-trace7, 491 rewrite-svc-send-trace8, 491 rewrite-svc-send-trace9, 491 rewrite-svc-tyi-trace1, 548 rewrite-svc-tyi-trace2, 548 rewrite-svc-tyi-trace3, 549 rewrite-svc-tyi-trace4, 550 rewrite-svc-tyi-trace5, 550 rewrite-svc-tyi-trace6, 550 rewrite-svc-tyi-trace7, 551 rewrite-svc-tyi-trace8, 552 rewrite-svc-tyi-trace9, 552 rewrite-svc-tyo-trace1, 571 rewrite-svc-tyo-trace10, 576 rewrite-svc-tyo-trace11, 576 rewrite-svc-tyo-trace12, 576 rewrite-svc-tyo-trace2, 571 rewrite-svc-tyo-trace3, 571 rewrite-svc-tyo-trace4, 573 rewrite-svc-tyo-trace5, 573 rewrite-svc-tyo-trace6, 573 rewrite-svc-tyo-trace7, 574 rewrite-svc-tyo-trace8, 574 rewrite-svc-tyo-trace9, 574 rewrite-waiting-input-trace1, 599 rewrite-waiting-input-trace10, 621 rewrite-waiting-input-trace11, 621 rewrite-waiting-input-trace12, 621 rewrite-waiting-input-trace13, 622 rewrite-waiting-input-trace14, 622 rewrite-waiting-input-trace15, 622 rewrite-waiting-input-trace16, 623 rewrite-waiting-input-trace17, 624 rewrite-waiting-input-trace18, 624 rewrite-waiting-input-trace2, 599 rewrite-waiting-input-trace3, 600 rewrite-waiting-input-trace4, 601 rewrite-waiting-input-trace5, 601 rewrite-waiting-input-trace6, 601 rewrite-waiting-input-trace7, 602 rewrite-waiting-input-trace8, 603 rewrite-waiting-input-trace9, 603 rewrite-waiting-output-trace1, 698 rewrite-waiting-output-trace10, 703 rewrite-waiting-output-trace11, 703 rewrite-waiting-output-trace12, 703 rewrite-waiting-output-trace2, 698 rewrite-waiting-output-trace3, 699 rewrite-waiting-output-trace4, 700 rewrite-waiting-output-trace5, 700 rewrite-waiting-output-trace6, 700 rewrite-waiting-output-trace7, 701 rewrite-waiting-output-trace8, 701 rewrite-waiting-output-trace9, 702 rewrite-zero-difference-as-equa

lity, 16

set-status-induction, 299 setp, 23–25, 27, 28, 66, 298 setp-index-ready-set, 298 setp-insert, 28 setp-permutation, 28 setp-permutation-base-case, 28 setp-permutation-induction, 27 setp-permutation-induction-step, 28 setp-remove, 27 size-of-tm-interrupting-input-p

ort, 125 size-of-tm-interrupting-output-p

ort, 125 sorted, 24–27, 302 sorted-index-ready-set, 302 sorted-insert, 25 sorted-remove, 26 status-flag-readyp, 292, 299–304, 306 status-flag-readyp-getnth, 299 status-flag-readyp-iff-member-i ndex-ready-set, 299 ndex-ready-set1, 299 status-flag-readyp-list, 301 strange-induction, 45 sub1-difference, 15 sum-zero-implies-addends-zero, 19 symmetry-of-disjoint, 194

table, 55–60, 328, 357, 363, 364, 369– 372, 377, 379, 380, 386, 387, 403, 404, 407, 410–414, 416, 418, 420–425, 427, 429, 430, 432–435, 740, 743, 746, 747, 750, 753, 754, 757, 758, 762, 765, 768, 769, 772–774, 778, 781, 784, 785, 787, 788, 791, 794, 795, 798, 801, 802, 805– 807, 809–811, 814–816, 818, 821, 824, 828–830, 832–834, 837–839, 841–843, 845, 846, 849, 850, 853, 854, 857–859, 864, 868, 869, 872–874, 877, 879, 880, 889, 892, 895, 898, 899, 902, 905, 909, 912, 919, 926, 930, 934, 937, 945, 953, 957, 960, 961, 964, 970, 974, 975, 977, 978, 980, 981, 986, 992, 996, 999, 1003, 1006, 1010, 1013, 1026, 1030, 1032, 1036, 1038, 1042, 1044, 1048, 1053, 1060, 1062, 1063, 1067, 1070, 1079, 1083, 1085, 1089, 1091, 1095

table-append, 57 table-flatten, 57 table-for-length, 57 table-putnth, 60 table-putseg, 60 table-putseg-inverse, 60 table-putseg-subcase, 59 tablep, 55–57, 61 tablep-table, 56 task, 272, 274, 275, 312, 315, 316 task-activep, 275, 314, 317 task-channels, 272, 275 task-communication-step, 275, 316 task-communicationp, 273, 275 task-destid, 274, 275, 315 task-execute-input, 275, 316 task-execute-output, 274, 275, 316 task-execute-receive, 274, 275, 315 task-execute-send, 274, 275, 315 task-fetch-execute, 274, 275 task-ibuffer-capacity, 272 task-ibuffers, 272, 274, 275, 277 task-idevid, 274 task-mbuffer-capacity, 273 task-mbuffers, 272–275, 277 task-message, 274, 275, 315, 316 task-obuffer-capacity, 272 task-obuffers, 272, 274, 275, 277 task-odevid, 274 task-private-step, 275 task-processor, 275, 276, 317, 1105 task-pstate, 273–275, 277 task-receive-instructionp, 273, 275 task-send-instructionp, 273, 275 task-shell, 272 task-shellp, 277 task-srcid, 273, 275, 315 task-step, 275, 276, 317 task-store-message, 274, 275 task-tyi-instructionp, 273 task-tyo-instructionp, 273, 275 task-update-channels, 275, 276, 314 task-update-control, 273–275 tick, 393 tick-plus, 393 timed-tm-implements-btimed-tm, 886 timed-tm-processor, 884–886 timed-tm-step, 884–886 timed-tm-step-implements-os-step, 886 times-1, 10 times-add1, 4 times-commutativity-associativit

y-crock, 389 times-difference, 6 times-equal-1, 9 times-id-iff-1, 8 times-identity, 9 times-identity1, 9 times-zero2, 3 times-zero3, 16 tm, 91–97, 217 tm-add-opcode, 110 tm-address-error, 99 tm-alu-arithmetic, 90 tm-alu-decr, 85, 86, 104 tm-alu-decr-mod, 85–87, 104 tm-alu-decr-mod-value-identical -to-ideal-result, 87 tm-alu-decr-value-identical-to-i

deal-result, 86 tm-alu-difference, 85, 104, 116, 117 tm-alu-incr, 85, 87, 104 tm-alu-incr-mod, 85, 87, 88, 105 tm-alu-incr-mod-value-identical -to-ideal-result, 88 tm-alu-incr-value-identical-to-i

deal-result, 87 tm-alu-mod, 85, 88, 89, 105 tm-alu-mod-value-identical-to-i

deal-result, 89 tm-alu-mult, 85, 89, 106 tm-alu-mult-value-identical-to-i

deal-result, 89 tm-alu-plus, 86, 89, 90, 103 tm-alu-plus-value-identical-to-i

deal-result, 90 tm-arg-datum, 101 tm-arg-index, 101 tm-arg-mode, 101 tm-arg1, 108, 111, 264, 265 tm-arg2, 109, 111, 264 tm-base, 92–97, 102, 103, 121, 131,

132, 160, 163, 167, 169–171, 176, 178, 179, 190–193, 195– 200, 207, 208, 218–272, 363, 379, 380, 739, 740, 746, 753, 754, 758, 762, 769, 773, 774, 777, 778, 784, 785, 788, 795, 798, 801, 806, 811, 815, 816, 829, 830, 834, 839, 842, 846, 849, 850, 854, 858, 859, 869, 873, 874, 876, 877, 880

tm-base-address-space, 207 tm-base-mapup-address-space, 224 tm-base-os, 363 tm-base-os-clock-interrupt-hand

ler, 739 tm-base-os-error-handler-path2, 746 tm-base-os-running-input-handle

r-path1, 829 r-path2, 834 r-path3, 839 r-path4, 842 r-path5, 846 r-path6, 849

tm-base-os-running-output-handle r-path1, 869 r-path2, 873 r-path3, 876 r-path4, 880

tm-base-os-svc-receive-handler-p ath2, 769 ath3, 773 ath4, 777

tm-base-os-svc-send-handler-pat h2, 753 h3, 758 h4, 762

tm-base-os-svc-tyi-handler-path 2, 784 3, 788

tm-base-os-svc-tyo-handler-path 2, 795 3, 798 4, 801 tm-base-os-waiting-input-handle

r-path1, 806 r-path2, 811 r-path3, 815

tm-base-os-waiting-output-handle r-path1, 854 r-path2, 858

tm-base-tm-limit-os-clock-inter

rupt-handler, 740 tm-base-tm-limit-os-error-handle

r-path2, 746 tm-base-tm-limit-os-running-inp

ut-handler-path1, 830 ut-handler-path2, 834 ut-handler-path3, 839 ut-handler-path4, 842 ut-handler-path5, 846 ut-handler-path6, 850

tm-base-tm-limit-os-running-outp ut-handler-path1, 869 ut-handler-path2, 873 ut-handler-path3, 877 ut-handler-path4, 880

tm-base-tm-limit-os-svc-receive -handler-path2, 769 -handler-path3, 774 -handler-path4, 778

tm-base-tm-limit-os-svc-send-ha ndler-path2, 753 ndler-path3, 758 ndler-path4, 762

tm-base-tm-limit-os-svc-tyi-han dler-path2, 785 dler-path3, 788

tm-base-tm-limit-os-svc-tyo-han dler-path2, 795 dler-path3, 798 dler-path4, 801

tm-base-tm-limit-os-waiting-inp ut-handler-path1, 806 ut-handler-path2, 811 ut-handler-path3, 816

tm-base-tm-limit-os-waiting-outp ut-handler-path1, 854

ut-handler-path2, 859 tm-br-opcode, 109 tm-brnz-opcode, 109 tm-brz-opcode, 109 tm-call-opcode, 109 tm-cc, 92–97, 103, 104, 112, 121,

122, 128, 167, 179, 206, 218– 254, 256–272, 387, 432, 434, 436, 438, 448, 460, 533, 553, 673, 913, 921, 939, 947, 965, 982, 988

tm-cc-divisor, 98 tm-cc-mapup-address-space, 226 tm-cc-value, 98, 103–106, 116, 117 tm-cc-value-on-compare-equal, 116 tm-cc-value-on-compare-greaterp, 117 tm-cc-value-on-compare-lessp, 117 tm-cc-value-on-compare-not-equa

l, 117 l-to-zero, 117

tm-cclub, 91 tm-ccsize, 91 tm-charlub, 92 tm-charsize, 91 tm-clear-input-interrupt, 100, 114,

126, 280, 999, 1006, 1013, 1017, 1020, 1024, 1030, 1036, 1042, 1047, 1051, 1056

tm-clear-output-interrupt, 101, 115, 126, 280, 673, 1063, 1074, 1084, 1094

tm-cleared-svcflag, 100 tm-clock, 92–97, 112, 122, 164, 168,

170–172, 176, 178, 179, 190– 193, 372, 892, 896, 902, 906, 912, 919, 926, 931, 937, 945, 953, 958, 964, 970, 974, 981, 986, 992, 999, 1006, 1013, 1016, 1020, 1024, 1030, 1036, 1042, 1047, 1051, 1056, 1063, 1070, 1073, 1077, 1083, 1089, 1094, 1098

tm-clock-interruptp, 112, 115, 193, 392, 883–885, 1103 tm-clock-new-pc-addr, 99 tm-clock-os-clock-interrupt-han

dler, 892 tm-clock-os-error-handler-path1, 896 tm-clock-os-error-handler-path2, 902 tm-clock-os-running-input-handle

r-path1, 1030 r-path2, 1036 r-path3, 1042 r-path4, 1047 r-path5, 1051 r-path6, 1056

tm-clock-os-running-output-hand ler-path1, 1083 ler-path2, 1089 ler-path3, 1094 ler-path4, 1098

tm-clock-os-svc-receive-handler -path1, 931 -path2, 937 -path3, 945 -path4, 953

tm-clock-os-svc-send-handler-pat h1, 906 h2, 912 h3, 919 h4, 926

tm-clock-os-svc-tyi-handler-pat h1, 958 h2, 964 h3, 970

tm-clock-os-svc-tyo-handler-pat h1, 974 h2, 981 h3, 986 h4, 992

tm-clock-os-waiting-input-handle r-path1, 999 r-path2, 1006 r-path3, 1013 r-path4, 1016 r-path5, 1020 r-path6, 1024

tm-clock-os-waiting-output-hand ler-path1, 1063 ler-path2, 1070 ler-path3, 1073 ler-path4, 1077

tm-clock-tm-fetch-execute, 193 tm-compare-opcode, 110 tm-compute-address, 101, 111, 264,

265 tm-compute-address-mapup-addres

s-space, 264 tm-cpu, 128–130, 370, 387, 403, 432,

433, 435, 889, 898, 899, 909, 913, 914, 921, 933, 934, 938, 939, 947, 960, 961, 965, 977, 978, 982, 988, 996, 1003, 1010, 1026, 1032, 1038, 1044, 1048, 1053, 1060, 1067, 1079, 1085, 1091, 1095

tm-cpu-length, 128 tm-cpu-os-clock-interrupt-handle

r, 889 r-case1, 889 r-case2, 889

tm-cpu-os-error-handler-path2, 899 tm-cpu-os-error-handler-path2-c

ase1, 898 ase2, 898

tm-cpu-os-running-input-handler -path1, 1026 -path1-crock, 1026 -path2, 1032 -path2-crock, 1032 -path3, 1038 -path3-crock, 1038 -path4, 1044 -path4-crock, 1044 -path5, 1048 -path5-crock, 1048 -path6, 1053 -path6-crock, 1053

tm-cpu-os-running-output-handle r-path1, 1079 r-path1-crock, 1079 r-path2, 1085 r-path2-crock, 1085 r-path3, 1091 r-path3-crock, 1091 r-path4, 1095 r-path4-crock, 1095 tm-cpu-os-svc-receive-handler-p

ath2, 934

ath2-case1, 933 ath2-case2, 934 ath3, 938 ath4, 947

tm-cpu-os-svc-send-handler-path 2-case1, 908 2-case2, 909 2, 909 3, 913 4, 921

tm-cpu-os-svc-tyi-handler-path2, 961 -case1, 960 -case2, 960

tm-cpu-os-svc-tyi-handler-path3, 965 tm-cpu-os-svc-tyo-handler-path2, 978

-case1, 977 -case2, 977

tm-cpu-os-svc-tyo-handler-path3, 982 tm-cpu-os-svc-tyo-handler-path4, 988 tm-cpu-os-waiting-input-handler

-path1, 996 -path2, 1003 -path3, 1009

tm-cpu-os-waiting-output-handle r-path1, 1060 r-path2, 1066

tm-datum1, 108 tm-datum2, 108, 109 tm-decr, 90, 91, 104, 112–114 tm-decr-mod-opcode, 110 tm-decr-opcode, 109 tm-decrement-clock, 112, 160, 162, 216, 267, 268, 385 tm-decrement-clock-commutes-wit h-mapup-address-space, 267

tm-definition, 131

tm-device-input-event, 115 tm-device-input-eventp, 115, 289, 309 tm-device-output-event, 115 tm-device-output-eventp, 115, 290,

309 tm-error, 92–97, 112, 121, 122, 128,

163, 169–171, 176, 178, 207, 218–254, 256–272, 387, 433, 434, 436, 438, 448, 460, 533, 553, 673, 913, 921, 939, 947, 965, 982, 988, 1102

tm-error-divisor, 98 tm-error-mapup-address-space, 227 tm-error-mapup-os-tasks, 1102 tm-error-mapup-task, 1102 tm-error-new-pc-addr, 99 tm-errorlub, 91 tm-errorp, 112, 115, 280, 439, 461,

498, 533, 553, 736, 737, 740, 747, 750, 751, 754, 758, 759, 762, 763, 766, 769, 770, 774, 775, 778, 779, 782, 785, 789, 792, 795, 796, 799, 802, 882– 885, 892, 906, 912, 920, 926, 927, 931, 937, 945, 946, 953, 954, 958, 964, 971, 975, 981, 987, 993, 1101, 1103

tm-errorsize, 91 tm-execute, 111, 112, 160, 193, 200,

204, 216, 269, 271, 385 tm-execute-add, 103, 110, 155, 163,

164, 196, 200, 210, 225, 226, 255, 381

tm-execute-add-commutes-with-map

up-address-space, 225 tm-execute-add-protection-theore

m, 195 tm-execute-binary, 110, 111, 160, 191,

192, 200, 204, 216, 255, 263, 264, 384

tm-execute-binary-commutes-with

-mapup-address-space, 263 tm-execute-binary-protection-the

orem, 200 tm-execute-binary1, 255, 262, 263 tm-execute-binary1-commutes-wit

h-mapup-address-space, 262 tm-execute-binary1-equals-tm-exe

cute-binary, 255 tm-execute-binary2, 255, 261, 262 tm-execute-binary2-commutes-wit

h-mapup-address-space, 260 tm-execute-binary3, 255, 260 tm-execute-binary3-commutes-wit

h-mapup-address-space, 259 tm-execute-binary4, 255, 258, 259 tm-execute-binary4-commutes-wit

h-mapup-address-space, 258 tm-execute-binary5, 255, 257, 258 tm-execute-binary5-commutes-wit

h-mapup-address-space, 257 tm-execute-binary6, 255–257 tm-execute-binary6-commutes-wit

h-mapup-address-space, 256 tm-execute-branch, 103, 110, 155,

196, 200, 211, 226, 248, 381 tm-execute-branch-commutes-with

-mapup-address-space, 226 tm-execute-branch-not-zero, 104, 110,

155, 196, 201, 211, 229, 248, 381

tm-execute-branch-not-zero-comm

utes-with-mapup-address-space,

229 tm-execute-branch-not-zero-prote

ction-theorem, 196 tm-execute-branch-on-zero, 103, 110,

155, 196, 201, 211, 228, 229, 248, 381

tm-execute-branch-on-zero-commute

s-with-mapup-address-space, 228 tm-execute-branch-on-zero-prote

ction-theorem, 196 tm-execute-branch-protection-the

orem, 196 tm-execute-call, 104, 110, 155, 167,

168, 196, 201, 211, 231, 248, 381

tm-execute-call-commutes-with-m

apup-address-space, 230 tm-execute-call-protection-theo

rem, 196 tm-execute-clock-interrupt, 112, 115,

162, 439, 884 tm-execute-commutes-with-mapup-

address-space, 270 tm-execute-compare, 104, 110, 155,

196, 201, 211, 231, 232, 255, 381

tm-execute-compare-commutes-wit

h-mapup-address-space, 231 tm-execute-compare-protection-t

heorem, 196 tm-execute-decr, 104, 110, 155, 169,

170, 196, 201, 211, 232, 248, 381

tm-execute-decr-commutes-with-m

apup-address-space, 232 tm-execute-decr-mod, 104, 110, 156,

170, 171, 197, 201, 212, 233, 255, 382

tm-execute-decr-mod-commutes-wit

h-mapup-address-space, 232 tm-execute-decr-mod-protection-t

heorem, 197 tm-execute-decr-protection-theo

rem, 196 tm-execute-error-interrupt, 113, 115,

162, 448, 884 tm-execute-incr, 104, 110, 156, 171,

197, 201, 212, 233, 234, 248, 382

tm-execute-incr-commutes-with-m

apup-address-space, 233 tm-execute-incr-mod, 104, 110, 156,

171, 172, 197, 202, 212, 234, 235, 255, 382

tm-execute-incr-mod-commutes-wit

h-mapup-address-space, 234 tm-execute-incr-mod-protection-t

heorem, 197 tm-execute-incr-protection-theo

rem, 197 tm-execute-input-interrupt, 114, 115,

162, 578, 884 tm-execute-instruction, 111, 160, 192,

200, 204, 216, 265, 267, 269, 384

tm-execute-instruction-commutes

-with-mapup-address-space, 266 tm-execute-instruction-protecti

on-theorem, 200 tm-execute-instruction1, 265, 266 tm-execute-instruction1-commute

s-with-mapup-address-space, 266 tm-execute-instruction1-equals-t

m-execute-instruction, 265 tm-execute-instruction2, 264–266 tm-execute-instruction2-commute

s-with-mapup-address-space, 265 tm-execute-load-base, 105, 110, 156,

197, 202, 212, 235, 248, 382 tm-execute-load-base-commutes-wit

h-mapup-address-space, 235 tm-execute-load-base-protection

-theorem, 197 tm-execute-load-limit, 105, 110, 156,

197, 202, 212, 236, 247, 382 tm-execute-load-limit-commutes-

with-mapup-address-space, 236 tm-execute-load-limit-protectio

n-theorem, 197 tm-execute-load-psw, 105, 110, 157,

197, 202, 212, 236, 247, 382 tm-execute-load-psw-commutes-wit

h-mapup-address-space, 236 tm-execute-load-psw-protection-t

heorem, 197 tm-execute-mod, 105, 110, 157, 176,

177, 198, 202, 213, 237, 255, 382

tm-execute-mod-commutes-with-map

up-address-space, 237 tm-execute-mod-protection-theore

m, 198 tm-execute-move, 106, 110, 157, 198,

202, 213, 238, 255, 383 tm-execute-move-commutes-with-m

apup-address-space, 237 tm-execute-move-protection-theo

rem, 198 tm-execute-multiply, 106, 111, 157,

178, 198, 202, 213, 238, 239, 255, 383

tm-execute-multiply-commutes-wit

h-mapup-address-space, 238 tm-execute-multiply-protection-t

heorem, 198 tm-execute-nullary, 109, 111, 159,

190, 199, 204, 215, 245, 247, 265, 384

tm-execute-nullary-commutes-wit

h-mapup-address-space, 246 tm-execute-nullary-protection-t

heorem, 199 tm-execute-nullary1, 245, 246 tm-execute-nullary1-commutes-wit

h-mapup-address-space, 246 tm-execute-nullary1-equals-tm-e

xecute-nullary, 245 tm-execute-nullary2, 245, 246 tm-execute-nullary2-commutes-wit

h-mapup-address-space, 245 tm-execute-output-interrupt, 114, 115,

163, 674, 884 tm-execute-post-output-interrupt, 106,

110, 159, 199, 203, 215, 243, 244, 247, 383

-commutes-with-mapup-address-

space, 243 -protection-theorem, 199

tm-execute-protection-theorem, 200 tm-execute-return, 106, 109, 158, 179,

198, 202, 214, 239, 240, 245, 383

tm-execute-return-commutes-with

-mapup-address-space, 239 tm-execute-return-protection-the

orem, 198 tm-execute-run, 106, 109, 158, 199,

203, 214, 240, 241, 245, 383 tm-execute-run-commutes-with-map

up-address-space, 240 tm-execute-run-protection-theore

m, 199 tm-execute-set-clock, 106, 110, 158,

198, 203, 214, 240, 247, 383 tm-execute-set-clock-commutes-wit

h-mapup-address-space, 240 tm-execute-set-clock-protection

-theorem, 198 tm-execute-start-output, 106, 111,

159, 199, 203, 215, 243, 255, 383

tm-execute-start-output-commute

s-with-mapup-address-space, 242 tm-execute-start-output-protecti

on-theorem, 199 tm-execute-svc, 106, 107, 110, 159,

199, 203, 215, 244, 247, 383 tm-execute-svc-commutes-with-map

up-address-space, 244 tm-execute-svc-interrupt, 113, 115,

162, 461, 498, 533, 553, 882, 884

tm-execute-svc-protection-theore

m, 199 tm-execute-svc-return, 107, 110, 159,

199, 204, 215, 245, 247, 384 tm-execute-svc-return-commutes-

with-mapup-address-space, 244 tm-execute-svc-return-protectio

n-theorem, 199 tm-execute-test-iport, 107, 110, 158,

198, 203, 214, 241, 242, 247, 384

tm-execute-test-iport-commutes-

with-mapup-address-space, 241 tm-execute-test-iport-protectio

n-theorem, 198 tm-execute-test-oport, 107, 110, 158,

198, 203, 214, 242, 247, 384 tm-execute-test-oport-commutes-

with-mapup-address-space, 242 tm-execute-test-oport-protectio

n-theorem, 198 tm-execute-unary, 110, 111, 160, 190,

191, 199, 204, 215, 248, 254, 255, 265, 384

tm-execute-unary-commutes-with-

mapup-address-space, 254 tm-execute-unary-protection-the

orem, 199 tm-execute-unary1, 248, 254 tm-execute-unary1-commutes-with

-mapup-address-space, 253 tm-execute-unary1-equals-tm-exe

cute-unary, 248 tm-execute-unary2, 248, 253 tm-execute-unary2-commutes-with

-mapup-address-space, 253 tm-execute-unary3, 248, 252 tm-execute-unary3-commutes-with

-mapup-address-space, 252 tm-execute-unary4, 248, 251, 252 tm-execute-unary4-commutes-with

-mapup-address-space, 251 tm-execute-unary5, 247, 248, 251 tm-execute-unary5-commutes-with

-mapup-address-space, 250 tm-execute-unary6, 247, 250 tm-execute-unary6-commutes-with

-mapup-address-space, 250 tm-execute-unary7, 247, 249, 250 tm-execute-unary7-commutes-with

-mapup-address-space, 249 tm-execute-unary8, 247, 249 tm-execute-unary8-commutes-with

-mapup-address-space, 248 tm-execute-wait, 107, 109, 158, 199,

203, 214, 241, 245, 384 tm-execute-wait-commutes-with-m

apup-address-space, 241 tm-execute-wait-protection-theo

rem, 199 tm-execute1, 269, 270 tm-execute1-commutes-with-mapup

-address-space, 270 tm-execute1-equals-tm-execute, 269 tm-execute2, 268–270 tm-execute2-commutes-with-mapup

-address-space, 269 tm-fetch, 103–107, 111, 132, 156, 209,

219 tm-fetch-arg1, 111, 268, 269 tm-fetch-arg1-mapup-address-spa

ce, 268 tm-fetch-arg2, 111, 268, 269 tm-fetch-arg2-mapup-address-spa

ce, 268 tm-fetch-execute, 112, 115, 162, 193,

200, 204, 216, 272, 274, 280, 316, 385–388, 390–392, 883, 884

tm-fetch-execute-commutes-with-

mapup-address-space, 271 tm-fetch-execute-mapup-address-

space-separation, 386 tm-fetch-execute-protection-the

orem, 200 tm-fetch-from-memory, 102, 103, 112,

131, 218 tm-fetch-from-memory-mapup-addre

ss-space, 217 tm-fetch-from-regmem, 102, 103, 218 tm-fetch-from-regmem-mapup-addre

ss-space, 218 tm-fetch-mapup-address-space, 218 tm-fetch-new-pc-on-interrupt, 112–

115 tm-fetch-opcode, 111, 112, 271 tm-fetch-opcode-mapup-address-sp

ace, 271 tm-fix-reg-address, 101, 118 tm-fix-reg-address-noop, 118 tm-fix-reg-address-size, 118 tm-fix-reg-address-size-linear, 118 tm-fix-word, 101, 117 tm-fix-word-noop, 117 tm-fix-word-size, 117 tm-fix-word-size-linear, 117 tm-good-address, 102–104, 110–112,

132, 155–160, 162, 195–198, 208, 209, 211, 213–215, 218, 220, 225, 226, 228–234, 237, 238, 244, 248–253, 255–260, 268, 269, 271, 379–383

tm-good-address-mapup-address-sp

ace, 230 tm-good-address-tm-decrement-cl

ock, 162 tm-good-address-tm-incr-tm-sp-f

or-address-space, 213 tm-good-address-tm-set-cc, 195 tm-good-address-tm-set-pc, 195 tm-good-address-tm-set-sp, 195 tm-good-address-tm-store, 162 tm-good-memory-tm-store, 133 tm-good-pc-address, 112 tm-good-regs-tm-store, 133 tm-good-supervisor-address, 156, 157 tm-good-supervisor-address-tm-g

ood-address, 157 tm-good-supervisor-address-tm-i

ncr-address, 157 ncrn-address, 157

tm-halt-status, 99 tm-ichar, 100, 114, 118, 125, 127,

287, 290, 306, 424, 425, 998, 1005, 1012, 1016, 1020, 1023, 1029, 1035, 1041, 1046, 1051, 1055

tm-ichar-facts, 127 tm-idatum, 115, 289 tm-idevid, 115, 289 tm-ierror-flag, 100, 118, 125, 127,

290, 306 tm-iinterrupt-flag, 100, 113, 118, 125,

290, 306 tm-implements-os, 887 tm-implements-timed-tm, 885 tm-in-supervisor-mode, 100, 102, 103,

105–108, 112–114, 131, 132, 156, 190–193, 195–200, 208, 217–220, 223–226, 228–254, 256–259, 261–271, 362, 378, 379, 737, 741, 744, 748, 751, 755, 760, 764, 767, 771, 776, 780, 783, 786, 790, 793, 797, 800, 804, 808, 813, 817, 820, 823, 827, 831, 836, 841, 844, 848, 852, 856, 860, 863, 867, 871, 875, 878, 1102

tm-in-supervisor-mode-good-addre

ss-space, 208 tm-in-supervisor-mode-mapup-add

ress-space, 235 tm-in-supervisor-mode-tm-decreme

nt-clock, 268 tm-in-supervisor-mode-tm-set-cc, 223 tm-in-supervisor-mode-tm-set-pc, 224 tm-in-supervisor-mode-tm-set-sp, 224 tm-in-supervisor-mode-tm-set-sv

cflag, 224 cid, 224

tm-incr, 90, 91, 102, 106, 158, 213,

214 tm-incr-address, 102, 157 tm-incr-mod-opcode, 110 tm-incr-opcode, 109 tm-incr-sp-is-add1-sp, 158 tm-incrn, 90, 91, 111, 268, 269 tm-incrn-address, 102, 105, 107, 112,

157 tm-index-size, 108 tm-index1, 108 tm-index1-divisor, 108 tm-index2, 108, 109 tm-input-char-addr, 99 tm-input-devid-addr, 99 tm-input-interruptp, 113, 115, 883–

885, 1103 tm-input-new-pc-addr, 99 tm-interrupt-addresses-os-clock

-interrupt-handler, 737 tm-interrupt-addresses-os-error

-handler-path1, 741 -handler-path2, 744

tm-interrupt-addresses-os-runni ng-input-handler-path1, 826 ng-input-handler-path2, 831 ng-input-handler-path3, 836 ng-input-handler-path4, 840 ng-input-handler-path5, 844 ng-input-handler-path6, 847 ng-output-handler-path1, 866 ng-output-handler-path2, 870 ng-output-handler-path3, 875 ng-output-handler-path4, 878

tm-interrupt-addresses-os-svc-re ceive-handler-path1, 763 ceive-handler-path2, 767 ceive-handler-path3, 771 ceive-handler-path4, 776

tm-interrupt-addresses-os-svc-se nd-handler-path1, 748 nd-handler-path2, 751 nd-handler-path3, 755 nd-handler-path4, 760

tm-interrupt-addresses-os-svc-t yi-handler-path1, 779 yi-handler-path2, 782 yi-handler-path3, 786 yo-handler-path1, 790 yo-handler-path2, 793 yo-handler-path3, 796 yo-handler-path4, 799

tm-interrupt-addresses-os-waiti ng-input-handler-path1, 803 ng-input-handler-path2, 808 ng-input-handler-path3, 812 ng-input-handler-path4, 817 ng-input-handler-path5, 820 ng-input-handler-path6, 823 ng-output-handler-path1, 851 ng-output-handler-path2, 855 ng-output-handler-path3, 860 ng-output-handler-path4, 863

tm-interrupting-input-port, 113, 114, 125, 127, 281, 307, 312, 420– 422, 424, 425, 582, 585, 588, 591, 600–603, 605, 608, 611, 613, 621, 623–625, 630, 633, 636, 638, 639, 641, 643, 645, 647, 648, 650, 652, 655, 658, 661, 668, 670–672, 802–807, 809–816, 818, 819, 821, 822, 824–835, 837–841, 843, 845– 848, 850, 998–1000, 1005– 1007, 1012–1014, 1016, 1017, 1020, 1021, 1023–1043, 1046, 1047, 1051, 1052, 1055–1057, 1101

tm-interrupting-output-port, 114, 115, 125–127, 281, 309, 312, 429, 431, 673, 677, 680, 682, 689, 691, 694, 699, 701–704, 709, 711, 714, 716, 718, 720, 723, 725, 730, 732, 734–736, 851– 859, 862, 864–874, 877, 879, 881, 1062–1064, 1069–1071, 1074, 1077–1090, 1094, 1098, 1099, 1101

tm-iport, 100 tm-iport-error-flag-is-zero, 127 tm-iport-errorp, 100, 107, 127, 287,

588, 591, 602, 603, 611, 613, 623–625, 636, 639, 648, 650, 658, 661, 670–672, 807, 811, 812, 816, 819, 822, 825, 831, 835, 839, 843, 846, 847, 850, 1007, 1014, 1021, 1025, 1037, 1043, 1052, 1056

tm-iportp, 118, 125, 290, 306 tm-iports, 92–97, 107, 113–115, 123–

127, 162, 164, 168, 170–172, 176, 178, 179, 190–193, 372, 420–422, 424, 425, 580, 582, 585, 588, 591, 593, 596, 598, 600–603, 605, 608, 611, 613, 616, 618, 620, 621, 623–625, 628, 630, 633, 636, 638, 639, 641, 643, 645, 647, 648, 650, 652, 655, 658, 661, 663, 665, 666, 668, 670–673, 802–807, 809–816, 818, 819, 821, 822, 824–835, 837–841, 843, 845– 848, 850, 882, 883, 892, 896, 902, 906, 912, 919, 926, 931, 937, 945, 953, 958, 964, 970, 974, 981, 986, 992, 996–1000, 1003–1007, 1010–1014, 1016, 1017, 1020, 1021, 1023–1057, 1063, 1070, 1074, 1077, 1084, 1089, 1094, 1098, 1101

tm-iports-os-clock-interrupt-ha

ndler, 892 tm-iports-os-error-handler-path

1, 896 2, 902

tm-iports-os-running-input-hand ler-path1, 1030 ler-path2, 1036 ler-path3, 1042 ler-path4, 1047 ler-path5, 1051 ler-path6, 1056

tm-iports-os-running-output-han dler-path1, 1084 dler-path2, 1089 dler-path3, 1094 dler-path4, 1098

tm-iports-os-svc-receive-handle r-path1, 931 r-path2, 937 r-path3, 945 r-path4, 953

tm-iports-os-svc-send-handler-p ath1, 906 ath2, 912 ath3, 919 ath4, 926

tm-iports-os-svc-tyi-handler-pat h1, 958 h2, 964 h3, 970

tm-iports-os-svc-tyo-handler-pat h1, 974 h2, 981 h3, 986 h4, 992

tm-iports-os-waiting-input-hand ler-path1, 999 ler-path2, 1006 ler-path3, 1013 ler-path4, 1017 ler-path5, 1020 ler-path6, 1024

tm-iports-os-waiting-output-han dler-path1, 1063 dler-path2, 1070 dler-path3, 1074 dler-path4, 1077 tm-lbase-opcode, 109 tm-limit, 92–97, 102, 103, 121, 131,

160, 163, 167, 169–171, 176, 178, 179, 190–193, 195–200, 207, 208, 217–272, 363, 379, 380, 739, 740, 746, 747, 753, 754, 758, 762, 769, 774, 778, 785, 788, 795, 798, 801, 802, 806, 811, 815, 816, 829, 830, 834, 839, 842, 843, 846, 849, 850, 854, 859, 869, 873, 874, 877, 880 tm-limit-address-space, 207 tm-limit-mapup-address-space, 224 tm-limit-os, 363 tm-limit-os-clock-interrupt-han

dler, 739 tm-limit-os-error-handler-path2, 746 tm-limit-os-running-input-handle

r-path1, 829 r-path2, 834 r-path3, 839 r-path4, 842 r-path5, 846 r-path6, 849

tm-limit-os-running-output-hand ler-path1, 869 ler-path2, 873 ler-path3, 877 ler-path4, 880

tm-limit-os-svc-receive-handler -path2, 769 -path3, 774 -path4, 778 tm-limit-os-svc-send-handler-pat

h2, 753 h3, 758 h4, 762

tm-limit-os-svc-tyi-handler-pat h2, 785 h3, 788

tm-limit-os-svc-tyo-handler-pat h2, 795 h3, 798 h4, 801

tm-limit-os-waiting-input-handle r-path1, 806 r-path2, 811 r-path3, 815

tm-limit-os-waiting-output-hand ler-path1, 854 ler-path2, 859

tm-llimit-opcode, 109 tm-lpsw-opcode, 109 tm-memlength, 92 tm-memory, 92–97, 102, 120, 133,

179, 195–204, 206, 209, 217– 254, 256–272, 276, 277, 290, 291, 294, 348, 362, 371, 375, 379, 380, 386, 387, 438, 448, 461, 533, 553, 673, 737, 741, 744, 748, 751, 755, 760, 763, 764, 767, 771, 776, 779, 780, 782, 783, 786, 790, 793, 796, 799, 800, 803, 808, 812, 813, 817, 820, 823, 826, 827, 831, 836, 840, 844, 847, 848, 851, 852, 855, 856, 860, 863, 866, 870, 871, 875, 878, 887, 893, 897, 903, 907, 913, 921, 928, 932, 938, 947, 955, 959, 965, 971, 976, 982, 988, 994, 1001, 1007, 1014, 1018, 1022, 1025, 1031, 1037, 1038, 1044, 1048, 1053, 1057, 1064, 1071, 1075, 1079, 1085, 1091, 1095

tm-mod-opcode, 110 tm-mode-size, 108 tm-mode1, 108 tm-mode1-divisor, 108 tm-mode2, 108, 109 tm-mode2-divisor, 108 tm-move-opcode, 110 tm-mult-opcode, 110 tm-no-error, 99 tm-no-svc, 100 tm-non-zero-carry-condition, 97 tm-non-zero-no-carry-condition, 97 tm-nullary-instructionp, 108, 111, 269,

322, 327 tm-obusy-flag, 100, 101, 118, 126,

290, 308 tm-ochar, 101, 118, 126, 290, 308 tm-odevid, 115, 290 tm-ointerrupt-flag, 114, 118, 126, 290,

308 tm-opcode, 108, 111, 264, 265, 330 tm-opcode-divisor, 108 tm-opcode-error, 99 tm-opcode-size, 108 tm-oport, 100, 101 tm-oport-idlep, 100, 107, 280, 568,

570, 575–577, 796, 799, 802, 987, 993

tm-oportp, 118, 126, 290, 308 tm-oports, 92–97, 106, 107, 114, 115,

123–127, 163, 164, 168, 170– 172, 177–179, 190–193, 372, 429, 431, 568, 570, 575–577, 673, 675, 677, 680, 682, 685, 687, 689, 691, 694, 696, 697, 699, 701–704, 706, 709, 711, 714, 716, 718, 720, 722, 723, 725, 727, 729, 730, 732–736, 796, 799, 802, 850–859, 862, 864–874, 877, 879–881, 883, 892, 896, 902, 906, 912, 919, 926, 931, 937, 945, 953, 958, 964, 970, 974, 981, 987, 992, 993, 999, 1006, 1013, 1017, 1021, 1024, 1031, 1037, 1043, 1047, 1052, 1056, 1060–1064, 1066–1071, 1074, 1077–1099, 1101

tm-oports-os-clock-interrupt-ha

ndler, 892 tm-oports-os-error-handler-path

1, 896 2, 902

tm-oports-os-running-input-hand ler-path1, 1031 ler-path2, 1037 ler-path3, 1043 ler-path4, 1047 ler-path5, 1052 ler-path6, 1056

tm-oports-os-running-output-han dler-path1, 1084 dler-path2, 1090 dler-path3, 1094 dler-path4, 1099

tm-oports-os-svc-receive-handle r-path1, 931 r-path2, 937 r-path3, 945 r-path4, 953

tm-oports-os-svc-send-handler-p ath1, 906 ath2, 912 ath3, 919 ath4, 926

tm-oports-os-svc-tyi-handler-pat h1, 958 h2, 964 h3, 970

tm-oports-os-svc-tyo-handler-pat h1, 974 h2, 981 h3, 987 h4, 992

tm-oports-os-waiting-input-hand ler-path1, 999 ler-path2, 1006 ler-path3, 1013 ler-path4, 1017 ler-path5, 1021

ler-path6, 1024 tm-oports-os-waiting-output-han

dler-path1, 1063 dler-path2, 1070 dler-path3, 1074 dler-path4, 1077 tm-output-devid-addr, 99 tm-output-interruptp, 114, 115, 883–

885, 1103 tm-output-new-pc-addr, 99 tm-overflow-char, 113, 127, 287, 424,

998, 1005, 1016, 1020, 1029, 1035, 1046, 1051 tm-pack-psw, 98, 112, 122, 128, 387,

389, 390, 396, 438, 448, 460, 533, 553, 673, 913–915, 921, 922, 939, 940, 947, 948, 965, 966, 982, 983, 988, 989

tm-pack-psw-tm-unpack-fields, 396 tm-pack-psw-tm-unpack-fields1, 396 tm-pack-psw-tm-unpack-fields2, 396 tm-pc, 97, 104, 111, 112, 122, 207,

228, 268, 269, 271, 438, 447, 460, 533, 553, 673

tm-pc-address, 92

tm-pc-address-error, 99

tm-pc-mapup-address-space, 227 tm-port-length, 92 tm-post-input-interrupt, 100, 115, 163,

289 tm-post-interrupt, 115, 116, 163, 385, 884–886, 1103, 1104

tm-post-opcode, 109

tm-post-output-interrupt, 101, 106,

115, 159, 280, 290, 987 tm-privilege-error, 99 tm-processor, 115, 116, 163, 440, 442,

444, 446, 447, 450, 452, 454, 455, 457–460, 463, 465, 468, 470, 472, 475, 477, 480, 483, 485–498, 501, 503, 505, 507, 510, 512, 514, 517, 519, 521– 532, 535, 537, 539, 541, 544, 546, 548–553, 555, 557, 560, 562, 564, 566, 568, 570–577, 580, 582, 585, 588, 591, 593, 596, 598–603, 606, 608, 611, 613, 616, 618, 620–625, 628, 630, 633, 636, 639, 641, 643, 645–650, 653, 655, 658, 661, 663, 665, 667–673, 675, 678, 680, 682, 685, 687, 689, 691, 694, 696–704, 706, 709, 711, 714, 716, 718, 720, 723, 725, 727, 729–736, 882–885, 887, 1105

tm-processor-append-oracle, 116 tm-processor-implements-timed-t

m-step, 885 tm-processor-oracle-distributes, 885 tm-processor-with-null-oracle, 116 tm-r0, 128 tm-r1, 128 tm-r2, 128, 273, 1100 tm-r3, 128, 273, 918, 925, 1100 tm-r4, 128 tm-r5, 128 tm-r6, 128 tm-r7, 128 tm-register-save-area-addr, 99 tm-reglength, 92 tm-regs, 92–97, 101, 102, 121, 128,

130, 133, 206, 209, 218–254, 256–272, 407, 408, 411, 413, 415, 431, 432, 434, 435, 1100

tm-regs-getnth-ak-pstates, 1100 tm-regs-mapup-os-tasks, 1100 tm-regs-mapup-task, 1100 tm-regsize, 91 tm-return-opcode, 109 tm-run-opcode, 109 tm-run-state, 100 tm-rwstate, 92–97, 100, 123, 164,

168, 170–172, 176, 178, 179, 190–193, 372, 892, 896, 902, 906, 912, 919, 926, 931, 937, 945, 953, 958, 964, 970, 974, 981, 987, 992, 999, 1006, 1013, 1016, 1020, 1024, 1030, 1036, 1042, 1047, 1051, 1056, 1063, 1070, 1073, 1077, 1083, 1089, 1094, 1098

tm-rwstate-os-clock-interrupt-h

andler, 892 tm-rwstate-os-error-handler-pat

h1, 896 h2, 902

tm-rwstate-os-running-input-han dler-path1, 1030 dler-path2, 1036 dler-path3, 1042 dler-path4, 1047 dler-path5, 1051 dler-path6, 1056

tm-rwstate-os-running-output-ha ndler-path1, 1083 ndler-path2, 1089 ndler-path3, 1094 ndler-path4, 1098

tm-rwstate-os-svc-receive-handle r-path1, 931 r-path2, 937 r-path3, 945 r-path4, 953

tm-rwstate-os-svc-send-handler-p ath1, 906 ath2, 912 ath3, 919 ath4, 926

tm-rwstate-os-svc-tyi-handler-p ath1, 958 ath2, 964 ath3, 970

tm-rwstate-os-svc-tyo-handler-p ath1, 974 ath2, 981 ath3, 987 ath4, 992

tm-rwstate-os-waiting-input-han dler-path1, 999 dler-path2, 1006 dler-path3, 1013 dler-path4, 1016 dler-path5, 1020 dler-path6, 1024

tm-rwstate-os-waiting-output-ha ndler-path1, 1063 ndler-path2, 1070 ndler-path3, 1073 ndler-path4, 1077

tm-set-base, 94, 105, 139 tm-set-cc, 93, 103–107, 136, 195, 210,

222, 223, 225, 378 tm-set-cc-commutes-with-mapup-a

ddress-space, 222 tm-set-clock, 96, 106, 112, 148 tm-set-error, 93, 104–115, 138, 210,

222, 245, 247, 248, 255, 264, 269, 378, 439, 448, 461, 533, 553, 673

tm-set-error-commutes-with-mapup

-address-space, 222 tm-set-iports, 96, 114, 115, 150, 385 tm-set-limit, 94, 95, 105, 140 tm-set-memory, 92, 102, 135, 439,

448, 461, 533, 553, 673 tm-set-oports, 97, 106, 115, 151, 385,

673 tm-set-pc, 97, 103–107, 111, 112, 152,

160, 195, 210, 221, 224, 269, 378, 439, 448, 461, 533, 553, 673

tm-set-pc-commutes-with-mapup-a

ddress-space, 221 tm-set-regs, 92, 97, 102, 133 tm-set-rwstate, 96, 106, 108, 114,

115, 147, 439, 448, 461, 533, 553, 673

tm-set-slimit, 95, 142 tm-set-sp, 97, 104–107, 112–115, 154,

195, 210, 221, 224, 225, 378, 439, 448, 461, 533, 553, 673

tm-set-sp-commutes-with-mapup-a

ddress-space, 221 tm-set-svcflag, 93, 105, 107, 144, 210,

223, 224, 273, 279, 378, 916, 917, 923, 924, 942, 943, 946, 950, 951, 968, 969, 984, 985, 990, 991

tm-set-svcflag-commutes-with-map up-address-space, 223 tm-set-svcflag-commutes-with-os -store-message, 946

tm-set-svcid, 94, 105, 107, 146, 210, 223, 224, 378 tm-set-svcid-commutes-with-mapup

-address-space, 223 tm-set-svmode, 95, 105, 107, 108,

112–115, 143, 439, 448, 461, 533, 553, 673

tm-shellp, 120, 205

tm-shellp-address-space, 205

tm-shellp-tm, 120 tm-shells, 126 tm-slimit, 92–97, 103, 112–114, 121,

163, 168–172, 176, 178, 179, 190–193, 360, 737, 740, 744, 748, 751, 755, 759, 763, 766, 770, 775, 779, 782, 786, 789, 792, 796, 799, 803, 807, 812, 816, 819, 823, 826, 831, 835, 840, 843, 847, 851, 855, 860, 862, 866, 870, 874, 878

tm-slimit-os, 360

tm-slimit-os-clock-interrupt-ha

ndler, 737 tm-slimit-os-error-handler-path

1, 740 2, 744

tm-slimit-os-running-input-hand ler-path1, 826 ler-path2, 831 ler-path3, 835 ler-path4, 840 ler-path5, 843 ler-path6, 847

tm-slimit-os-running-output-han dler-path1, 866 dler-path2, 870 dler-path3, 874

dler-path4, 878 tm-slimit-os-svc-receive-handle

r-path1, 763 r-path2, 766 r-path3, 770 r-path4, 775

tm-slimit-os-svc-send-handler-p ath1, 748 ath2, 751 ath3, 755 ath4, 759

tm-slimit-os-svc-tyi-handler-pat h1, 779 h2, 782 h3, 786

tm-slimit-os-svc-tyo-handler-pat h1, 789 h2, 792 h3, 796 h4, 799

tm-slimit-os-waiting-input-hand ler-path1, 803 ler-path2, 807 ler-path3, 812 ler-path4, 816 ler-path5, 819 ler-path6, 823

tm-slimit-os-waiting-output-han dler-path1, 851 dler-path2, 855 dler-path3, 860 dler-path4, 862

tm-some-input-interruptp, 113, 125, 127, 162, 281, 307, 420, 421, 580, 582, 585, 588, 591, 593, 596, 598, 600, 601, 603, 605, 608, 611, 613, 616, 618, 620, 621, 623–625, 628, 630, 633, 636, 638, 641, 643, 645, 647, 648, 650, 652, 655, 658, 661, 663, 665, 666, 668, 670, 671, 673, 802–807, 809–812, 814– 816, 818, 819, 821, 822, 824– 826, 828–830, 832–835, 837– 841, 843, 845–848, 850, 882, 883, 996–1000, 1003–1007, 1010–1013, 1016, 1017, 1020, 1021, 1023–1057, 1101 tm-some-output-interruptp, 114, 125–

127, 163, 281, 309, 429, 675, 677, 680, 682, 685, 687, 689, 691, 694, 696, 697, 699, 701– 704, 706, 709, 711, 714, 716, 718, 720, 722, 725, 727, 729, 730, 732, 733, 735, 736, 850, 851, 853–855, 857–859, 862, 864, 865, 868–870, 872–874, 877, 879–881, 883, 1060– 1063, 1066–1070, 1074, 1077– 1099, 1101

tm-sp, 97, 103, 104, 106, 112, 122, 158, 207, 213, 214, 228, 438, 448, 460, 533, 553, 673

tm-sp-address, 92

tm-sp-mapup-address-space, 228 tm-stack-overflow-error, 99 tm-stack-overflowp, 103, 104, 230 tm-stack-overflowp-mapup-addres

s-space, 229 tm-stack-underflow-error, 99 tm-stack-underflowp, 103, 106, 158,

213, 239 tm-stack-underflowp-guards-good

-address, 103 tm-stack-underflowp-mapup-addre

ss-space, 239 tm-start-output, 101, 106, 159, 281, 1070, 1078, 1090, 1099

tm-step, 115, 116, 163

tm-store, 103–106, 112–114, 133, 162, 195, 200, 209, 220, 221, 273, 380

tm-store-commutes-with-mapup-ad

dress-space, 220 tm-store-in-memory, 102, 103, 195,

219, 380 tm-store-in-memory-commutes-wit h-mapup-address-space, 219 tm-store-in-memory-protection-t

heorem, 195 tm-store-in-regmem, 102, 103, 220,

378 tm-store-in-regmem-commutes-wit

h-mapup-address-space, 219 tm-store-interrupting-input-devi

ce, 114 tm-store-interrupting-output-devi

ce, 114, 115 tm-store-old-psw-on-interrupt, 112–

115 tm-store-protection-theorem, 195 tm-store-svcid-on-interrupt, 113 tm-stout-opcode, 110 tm-supervisor-mode, 99 tm-svc, 100 tm-svc-interruptp, 113, 115, 273, 280,

883–885, 1103 tm-svc-new-pc-addr, 99 tm-svc-opcode, 109 tm-svc-return-opcode, 109 tm-svcflag, 92–97, 112, 113, 122, 128,

163, 164, 168–172, 176, 178, 179, 190, 191, 207, 218–254, 256–272, 387, 433, 438, 448, 460, 533, 553, 673, 1102

tm-svcflag-divisor, 98 tm-svcflag-mapup-address-space, 227 tm-svcflag-mapup-os-tasks, 1102 tm-svcflag-mapup-task, 1102 tm-svcflaglub, 92 tm-svcflagsize, 91 tm-svcid, 92–97, 112, 113, 122, 128,

164, 168–172, 176, 178, 179, 190, 191, 207, 218–254, 256– 273, 279, 387, 433, 434, 436, 438, 448, 460, 465, 467, 475, 488, 489, 492, 494, 496, 498, 500, 503, 509, 522, 524, 526, 528, 531–533, 537, 549, 550, 552, 553, 557, 560, 566, 572, 573, 575–577, 673, 747, 750, 751, 754, 758, 759, 762, 763, 766, 770, 774, 775, 778, 779, 782, 785, 789, 792, 795, 796, 799, 802, 881, 906, 913, 920, 921, 927, 931, 938, 939, 946, 947, 954, 958, 964, 965, 971, 975, 981, 982, 987, 988, 993, 1099, 1100

tm-svcid-addr, 99 tm-svcid-getnth-ak-pstates, 1100 tm-svcid-mapup-address-space, 227 tm-svcid-mapup-os-tasks, 1100 tm-svcid-mapup-task, 1099 tm-svcidlub, 92 tm-svcidsize, 91 tm-svmode, 92–97, 100, 122, 163,

168–172, 176, 178, 179, 190– 193, 208

tm-svmode-address-space, 208 tm-testi-opcode, 109 tm-testo-opcode, 109 tm-time-opcode, 109 tm-unary-instructionp, 108, 111, 269,

323, 327 tm-unpack-cc, 98, 105, 107, 371, 389,

396, 403 tm-unpack-cc-tm-pack-psw, 389 tm-unpack-error, 98, 105, 107, 371,

389, 396, 403 tm-unpack-error-tm-pack-psw, 389 tm-unpack-svcflag, 98, 99, 105, 371,

389, 396, 403 tm-unpack-svcflag-tm-pack-psw, 389 tm-unpack-svcid, 98, 99, 105, 107,

371, 390, 396, 403 tm-unpack-svcid-tm-pack-psw, 390 tm-user-mode, 100 tm-wait-opcode, 109 tm-wait-state, 100 tm-waiting, 100, 115, 363–365, 370,

377, 380–388, 390–392, 404, 411, 412, 420, 429, 432–436, 439, 440, 442, 444, 446–448, 450, 452, 454, 455, 457, 458, 460, 461, 463, 465, 467, 470, 472, 475, 477, 480, 482, 485– 489, 492, 494, 496, 498, 500, 503, 505, 507, 509, 512, 514, 517, 519, 521, 522, 524, 526, 528, 531–533, 535, 537, 539, 541, 543, 546, 548–550, 552, 553, 555, 557, 560, 562, 564, 566, 568, 570, 572, 573, 575– 577, 580, 582, 585, 588, 591, 593, 596, 598, 600, 601, 603, 605, 608, 611, 613, 616, 618, 620, 621, 623–625, 628, 630, 633, 636, 638, 641, 643, 645, 647, 648, 650, 652, 655, 658, 661, 663, 665, 666, 668, 670, 671, 673, 675, 677, 680, 682, 685, 687, 689, 691, 694, 696, 697, 699, 701–704, 706, 709, 711, 714, 716, 718, 720, 722, 725, 727, 729, 730, 732, 733, 735–740, 743, 744, 746, 747, 750, 753, 754, 757–759, 761– 763, 765, 766, 768–775, 777– 779, 781, 782, 784, 785, 787– 789, 791, 792, 794–799, 801– 803, 806, 807, 810–812, 815, 816, 819, 822, 825, 826, 829, 830, 833–835, 838–840, 842, 843, 846, 847, 849–851, 853– 855, 858, 859, 862, 864, 865, 868–870, 873, 874, 876, 877, 880–885, 889–896, 898–906, 908–931, 933–958, 960–975, 977–993, 996–1000, 1003– 1007, 1010–1019, 1021–1057, 1060–1062, 1064, 1066–1076, 1078–1103

tm-waiting-iff-array-qemptyp-os

-readyq, 364 tm-waiting-os-error-handler-pat

h1, 743 tm-waiting-os-svc-receive-handle

r-path1, 766 tm-waiting-os-svc-send-handler-p

ath1, 750 tm-waiting-os-svc-tyi-handler-p

ath1, 781 tm-waiting-os-svc-tyo-handler-p

ath1, 792 tm-waiting-os-waiting-input-han

dler-path4, 819 dler-path5, 822 dler-path6, 825

tm-waiting-os-waiting-output-ha ndler-path3, 862 ndler-path4, 864

tm-waiting-tm-fetch-execute, 388 tm-wordlub, 85 tm-wordsize, 85 tm-zero-carry-condition, 97 tm-zero-no-carry-condition, 97 trace-arithmetic, 395 trace-array-queue-facts, 396 trace-clock-interrupt-handler, 447 trace-clock-interrupt-handler-t hru-save-state, 440 o-dispatcher, 442 o-finish, 446 o-restore-state, 444 trace-error-handler-path1, 458 trace-error-handler-path2, 460 trace-error-handler-thru-save-st

ate, 450 trace-error-handler-to-dispatche

r, 452 trace-error-handler-to-finish, 457 trace-error-handler-to-restore-

state, 455 trace-error-handler-to-wait-state, 454 trace-input-interrupt-handler, 882 trace-os-error-handler, 460 trace-output-interrupt-handler, 883 trace-running-input-handler, 673 trace-running-input-handler-pat

h1, 647 h2, 648 h3, 650 h4, 668 h5, 670 h6, 671

trace-running-input-handler-thr

u-save-state, 628 trace-running-input-handler-to-

lpsw1, 641 lpsw2, 643 lpsw3, 645 lpsw4, 663 lpsw5, 665 lpsw6, 666 resume-task1, 633 resume-task2, 636 resume-task3, 638 resume-task4, 655 resume-task5, 658 resume-task6, 661

trace-running-input-handler-to-i buffer-full-test, 630 buffer-full-test2, 652

trace-running-output-handler, 736 trace-running-output-handler-pat

h1, 730 h2, 732 h3, 733 h4, 735

trace-running-output-handler-th

ru-save-state, 706 trace-running-output-handler-to

-lpsw1, 716 -lpsw2, 718 -lpsw3, 727 -lpsw4, 729 -obuffer-empty-test, 709 -obuffer-empty-test2, 720 -resume-task1, 711 -resume-task2, 714 -resume-task3, 722 -resume-task4, 725

trace-svc-interrupt-handler, 882 trace-svc-receive-handler, 532 trace-svc-receive-handler-path1, 522 trace-svc-receive-handler-path2, 524 trace-svc-receive-handler-path3, 526 trace-svc-receive-handler-path4, 531

a, 528 b, 531

trace-svc-receive-handler-thru-delivery, 509 save-state, 498

trace-svc-receive-handler-to-di

spatcher, 503 trace-svc-receive-handler-to-lp

sw, 507 trace-svc-receive-handler-to-qe mptyp-test, 500 trace-svc-receive-handler-to-sv c-resume-task1, 512 c-resume-task2, 514 c-resume-task3, 517 cr1, 519 cr2, 521 cr3, 521

trace-svc-receive-handler-to-wait

-state, 505 trace-svc-send-handler, 498 trace-svc-send-handler-path1, 488 trace-svc-send-handler-path2, 489 trace-svc-send-handler-path3, 492 trace-svc-send-handler-path4, 496 trace-svc-send-handler-path4a, 494 trace-svc-send-handler-path4b, 496 trace-svc-send-handler-thru-enq

ueue, 475 trace-svc-send-handler-thru-save

-state, 463 trace-svc-send-handler-to-dispat

cher, 467 trace-svc-send-handler-to-lpsw, 472 trace-svc-send-handler-to-qfullp

-test, 465 trace-svc-send-handler-to-svc-re

sume-task1, 477 sume-task2, 480 sume-task3, 482

trace-svc-send-handler-to-svcr1, 484 trace-svc-send-handler-to-svcr2, 486 trace-svc-send-handler-to-svcr3, 487 trace-svc-send-handler-to-wait-

state, 470 trace-svc-tyi-handler, 553 trace-svc-tyi-handler-path1, 549 trace-svc-tyi-handler-path2, 550 trace-svc-tyi-handler-path3, 552 trace-svc-tyi-handler-thru-delive

ry, 546 trace-svc-tyi-handler-thru-save

-state, 535 trace-svc-tyi-handler-to-dispat

cher, 539 trace-svc-tyi-handler-to-lpsw, 543 trace-svc-tyi-handler-to-qemptyp

-test, 537 trace-svc-tyi-handler-to-svcr, 548 trace-svc-tyi-handler-to-wait-st

ate, 541 trace-svc-tyo-handler, 577 trace-svc-tyo-handler-path1, 572 trace-svc-tyo-handler-path2, 573 trace-svc-tyo-handler-path3, 575 trace-svc-tyo-handler-path4, 576 trace-svc-tyo-handler-thru-enque

ue, 566 trace-svc-tyo-handler-thru-save

-state, 555 trace-svc-tyo-handler-to-dispat

cher, 560 trace-svc-tyo-handler-to-lpsw, 564 trace-svc-tyo-handler-to-qfullp

-test, 557 trace-svc-tyo-handler-to-svcr1, 568 trace-svc-tyo-handler-to-svcr2, 570 trace-svc-tyo-handler-to-wait-st

ate, 562 trace-waiting-input-handler, 625 trace-waiting-input-handler-pat

h1, 600 h2, 601 h3, 603 h4, 621 h5, 623 h6, 624 trace-waiting-input-handler-thr

u-readyq-empty-test, 580 trace-waiting-input-handler-to-

dispatcher1, 585 dispatcher2, 588 dispatcher3, 590 dispatcher4, 608 dispatcher5, 611 dispatcher6, 613 lpsw1, 593 lpsw2, 596 lpsw3, 598 wait1, 616 wait2, 618 wait3, 620

trace-waiting-input-handler-to-i buffer-full-test, 582 buffer-full-test2, 605

trace-waiting-output-handler, 704 trace-waiting-output-handler-pat

h1, 699 h2, 700 h3, 702 h4, 703

trace-waiting-output-handler-th

ru-readyq-empty-test, 675 trace-waiting-output-handler-to

-dispatcher1, 680 -dispatcher2, 682 -dispatcher3, 691 -dispatcher4, 694 -lpsw1, 685 -lpsw2, 687 -obuffer-empty-test, 677 -obuffer-empty-test2, 689 -wait1, 695 -wait2, 697

tracing-lemmas, 395 transitivity-of-permutation, 27 transitivity-of-permutation-base

-case, 27 transitivity-of-permutation-ind

uction, 27 uction-step, 27 translate-dc, 319, 325 translate-dc-arg, 319 translate-dc-arglist, 319 translate-instruction, 325 translate-source, 325, 329

yet-another-difference-plus-cro ck, 15

zerop-remainder-difference, 17