[STATEMENT]
lemma subst_fml_hp:
  fixes I::"('sf, 'sc, 'sz) interp"
  assumes good_interp:"is_interp I"
  shows
  "(Padmit \<sigma> \<alpha> \<longrightarrow>
    (hpsafe \<alpha> \<longrightarrow>
     ssafe \<sigma> \<longrightarrow>
    (\<forall> \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst \<alpha> \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) \<alpha>))))
    \<and>
    (Fadmit \<sigma> \<phi> \<longrightarrow>
    (fsafe \<phi> \<longrightarrow>
    ssafe \<sigma> \<longrightarrow>
    (\<forall> \<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjoint I \<sigma> \<nu>) \<phi>))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Padmit \<sigma> \<alpha> \<longrightarrow> hpsafe \<alpha> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst \<alpha> \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) \<alpha>))) \<and> (Fadmit \<sigma> \<phi> \<longrightarrow> fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)))
[PROOF STEP]
proof (induction rule: Padmit_Fadmit.induct)
[PROOF STATE]
proof (state)
goal (17 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 4. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 7. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 17 subgoals...
[PROOF STEP]
case (Padmit_Pvar \<sigma> a)
[PROOF STATE]
proof (state)
this:

goal (17 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 4. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 7. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 17 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
have "hpsafe ($\<alpha> a) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))
[PROOF STEP]
apply (cases "SPrograms \<sigma> a")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<nu> \<omega>. \<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>; SPrograms \<sigma> a = None\<rbrakk> \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a))
 2. \<And>\<nu> \<omega> aa. \<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>; SPrograms \<sigma> a = Some aa\<rbrakk> \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a))
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<nu> \<omega>. \<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>; SPrograms \<sigma> a = None\<rbrakk> \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<alpha> a))
 2. \<And>\<nu> \<omega> aa. \<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>; SPrograms \<sigma> a = Some aa\<rbrakk> \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> ($\<alpha> a))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<alpha> a))

goal (17 subgoals):
 1. \<And>\<sigma> a. hpsafe ($\<alpha> a) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 3. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 4. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 5. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 7. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 9. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 10. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 17 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<alpha> a))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe ($\<alpha> a); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<alpha> a))

goal (1 subgoal):
 1. hpsafe ($\<alpha> a) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe ($\<alpha> a) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst ($\<alpha> a) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) ($\<alpha> a)))

goal (16 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 16 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (16 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 16 subgoals...
[PROOF STEP]
case (Padmit_Sequence \<sigma> a b)
[PROOF STATE]
proof (state)
this:
Padmit \<sigma> a
Padmit \<sigma> b
PUadmit \<sigma> b (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))

goal (16 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 16 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Padmit \<sigma> a
Padmit \<sigma> b
PUadmit \<sigma> b (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))
[PROOF STEP]
have PUA:"PUadmit \<sigma> b (BVP (Psubst a \<sigma>))"
    and PA:"Padmit \<sigma> a"
    and IH1:"hpsafe a \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))"
    and IH2:"hpsafe b \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))"
    and substSafe:"hpsafe (Psubst a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
Padmit \<sigma> a
Padmit \<sigma> b
PUadmit \<sigma> b (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))

goal (1 subgoal):
 1. (PUadmit \<sigma> b (BVP (Psubst a \<sigma>)) &&& Padmit \<sigma> a) &&& (\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))) &&& (\<lbrakk>hpsafe b; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))) &&& hpsafe (Psubst a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
PUadmit \<sigma> b (BVP (Psubst a \<sigma>))
Padmit \<sigma> a
\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
\<lbrakk>hpsafe b; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst b \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) b)
hpsafe (Psubst a \<sigma>)

goal (16 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 16 subgoals...
[PROOF STEP]
have "hpsafe (a ;; b) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
assume hpsafe:"hpsafe (a ;; b)"
[PROOF STATE]
proof (state)
this:
hpsafe (a ;; b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
from hpsafe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (a ;; b)
[PROOF STEP]
have safe1:"hpsafe a" and safe2:"hpsafe b"
[PROOF STATE]
proof (prove)
using this:
hpsafe (a ;; b)

goal (1 subgoal):
 1. hpsafe a &&& hpsafe b
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe a
hpsafe b

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have agree:"\<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (-BVP(Psubst a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
subgoal for \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(Psubst a \<sigma>)" \<nu>, OF substSafe]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (Psubst a \<sigma>))

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<mu>7 (- BVP (Psubst a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have sem_eq:"\<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow>
        ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) =
        ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
subgoal for \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
assume assm:"(\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>)"
[PROOF STATE]
proof (state)
this:
(\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>)

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
show "((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
using uadmit_prog_adjoint[OF PUA agree[OF assm] safe2 ssafe good_interp]
[PROOF STATE]
proof (prove)
using this:
prog_sem (local.adjoint I \<sigma> \<nu>) b = prog_sem (local.adjoint I \<sigma> \<mu>) b

goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((?\<mu>7, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((?\<mu>7, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> ?\<mu>7) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<mu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
using IH2[OF safe2 ssafe]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst b \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) b)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
[PROOF STEP]
using sem_eq
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<mu>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((?\<mu>7, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = ((?\<mu>7, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> ?\<mu>7) b)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
have "... = (\<exists> \<mu>. (\<nu>, \<mu>) \<in> prog_sem (adjoint I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
[PROOF STEP]
using IH1[OF safe1 ssafe]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)

goal (1 subgoal):
 1. (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>))
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b))"
[PROOF STATE]
proof (prove)
using this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>))
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)
(\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b) = (\<exists>\<mu>. (\<nu>, \<mu>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> (\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (a ;; b))

goal (16 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)); PUadmit \<sigma> b (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
 2. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 3. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 4. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 6. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 8. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 9. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
A total of 16 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (a ;; b))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (a ;; b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (a ;; b))

goal (1 subgoal):
 1. hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (a ;; b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a ;; b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a ;; b)))

goal (15 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 3. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
A total of 15 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (15 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 3. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
A total of 15 subgoals...
[PROOF STEP]
case (Padmit_Loop \<sigma> a)
[PROOF STATE]
proof (state)
this:
Padmit \<sigma> a
PUadmit \<sigma> a (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))

goal (15 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 3. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
A total of 15 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Padmit \<sigma> a
PUadmit \<sigma> a (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
[PROOF STEP]
have PA:"Padmit \<sigma> a"
    and PUA:"PUadmit \<sigma> a (BVP (Psubst a \<sigma>))"
    and IH:"hpsafe a \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))"
    and substSafe:"hpsafe (Psubst a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
Padmit \<sigma> a
PUadmit \<sigma> a (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))

goal (1 subgoal):
 1. (Padmit \<sigma> a &&& PUadmit \<sigma> a (BVP (Psubst a \<sigma>))) &&& (\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))) &&& hpsafe (Psubst a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Padmit \<sigma> a
PUadmit \<sigma> a (BVP (Psubst a \<sigma>))
\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
hpsafe (Psubst a \<sigma>)

goal (15 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 3. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
A total of 15 subgoals...
[PROOF STEP]
have "hpsafe (a**) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a**)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
assume "hpsafe (a**)"
[PROOF STATE]
proof (state)
this:
hpsafe a**

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hpsafe a**
[PROOF STEP]
have hpsafe:"hpsafe a"
[PROOF STATE]
proof (prove)
using this:
hpsafe a**

goal (1 subgoal):
 1. hpsafe a
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe a

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have agree:"\<And>\<nu> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (-BVP(Psubst a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<mu>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
subgoal for \<nu> \<mu>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(Psubst a \<sigma>)" \<nu>, OF substSafe]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (Psubst a \<sigma>))

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<mu> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(?\<nu>7, ?\<mu>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree ?\<nu>7 ?\<mu>7 (- BVP (Psubst a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have sem_eq:"\<And>\<nu> \<mu> \<omega>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow>
      ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) =
      ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<mu> \<omega>. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)
[PROOF STEP]
subgoal for \<nu> \<mu> \<omega>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)
[PROOF STEP]
assume assm:"(\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>)"
[PROOF STATE]
proof (state)
this:
(\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>)

goal (1 subgoal):
 1. (\<nu>, \<mu>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)
[PROOF STEP]
show "((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)
[PROOF STEP]
using uadmit_prog_adjoint[OF PUA agree[OF assm] hpsafe ssafe good_interp]
[PROOF STATE]
proof (prove)
using this:
prog_sem (local.adjoint I \<sigma> \<nu>) a = prog_sem (local.adjoint I \<sigma> \<mu>) a

goal (1 subgoal):
 1. ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = ((\<mu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<mu>) a)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(?\<nu>7, ?\<mu>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> ((?\<mu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a) = ((?\<mu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<mu>7) a)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have UN_rule:"\<And> a S S'. (\<And>n b. (a,b) \<in> S n \<longleftrightarrow> (a,b) \<in> S' n) \<Longrightarrow> (\<And>b. (a,b) \<in> (\<Union>n. S n) \<longleftrightarrow> (a,b) \<in> (\<Union>n. S' n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a S S'. (\<And>n b. ((a, b) \<in> S n) = ((a, b) \<in> S' n)) \<Longrightarrow> (\<And>b. ((a, b) \<in> \<Union> (range S)) = ((a, b) \<in> \<Union> (range S')))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<And>n b. ((?a7, b) \<in> ?S7 n) = ((?a7, b) \<in> ?S'7 n)) \<Longrightarrow> ((?a7, ?b7) \<in> \<Union> (range ?S7)) = ((?a7, ?b7) \<in> \<Union> (range ?S'7))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have eqL:"((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem I (Psubst a \<sigma>)) ^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>)))))
[PROOF STEP]
using rtrancl_is_UN_relpow
[PROOF STATE]
proof (prove)
using this:
?R\<^sup>* = \<Union> (range ((^^) ?R))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>)))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>)))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>)))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have eachEq:"\<And>n. ((\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> (prog_sem I (Psubst a \<sigma>)) ^^ n) = ((\<nu>, \<omega>) \<in> (prog_sem (adjoint I \<sigma> \<nu>) a)^^ n)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
fix n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
show "((\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> (prog_sem I (Psubst a \<sigma>)) ^^ n) = ((\<nu>, \<omega>) \<in> (prog_sem (adjoint I \<sigma> \<nu>) a)^^ n)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
proof (induct n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ 0)
 2. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ 0)
 2. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ 0)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ 0) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ 0)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)
[PROOF STEP]
have IH2:"\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)"
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)

goal (1 subgoal):
 1. \<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
have relpow:"\<And>R n. R ^^ Suc n = R O R ^^ n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>R n. R ^^ Suc n = R O R ^^ n
[PROOF STEP]
using relpow.simps(2) relpow_commute
[PROOF STATE]
proof (prove)
using this:
?R ^^ Suc ?n = ?R ^^ ?n O ?R
?R O ?R ^^ ?n = ?R ^^ ?n O ?R

goal (1 subgoal):
 1. \<And>R n. R ^^ Suc n = R O R ^^ n
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
?R8 ^^ Suc ?n8 = ?R8 O ?R8 ^^ ?n8

goal (1 subgoal):
 1. \<And>n \<nu> \<omega>. (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)) \<Longrightarrow> ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)
[PROOF STEP]
apply (simp only: relpow[of n "prog_sem I (Psubst a \<sigma>)"] relpow[of n "prog_sem (adjoint I \<sigma> \<nu>) a"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) O prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a O prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
apply(unfold relcomp_unfold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> {(x, z). \<exists>y. (x, y) \<in> prog_sem I (Psubst a \<sigma>) \<and> (y, z) \<in> prog_sem I (Psubst a \<sigma>) ^^ n}) = ((\<nu>, \<omega>) \<in> {(x, z). \<exists>y. (x, y) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> (y, z) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n})
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem I (Psubst a \<sigma>); ((aa, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> ((aa, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
 2. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((aa, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (Psubst a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n
[PROOF STEP]
subgoal for ab b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> ((aa, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply(rule exI[where x=ab])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> \<exists>b. (\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply(rule exI[where x=b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
using IH2 IH[OF hpsafe ssafe] sem_eq[of \<nu> "(ab,b)" \<omega>]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
(\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> (((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = (((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>); ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
using uadmit_prog_adjoint[OF PUA agree hpsafe ssafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>) a = prog_sem (local.adjoint I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)

goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
using uadmit_prog_adjoint[OF PUA agree hpsafe ssafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>) a = prog_sem (local.adjoint I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa b. \<lbrakk>(\<nu>, aa, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((aa, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (Psubst a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n
[PROOF STEP]
subgoal for ab b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>aa b. (\<nu>, aa, b) \<in> prog_sem I (Psubst a \<sigma>) \<and> ((aa, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n
[PROOF STEP]
apply(rule exI[where x=ab])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> \<exists>b. (\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n
[PROOF STEP]
apply(rule exI[where x=b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n
[PROOF STEP]
using IH2 IH[OF hpsafe ssafe] sem_eq[of \<nu> "(ab,b)" \<omega>]
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
(\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> (((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a) = (((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n\<rbrakk> \<Longrightarrow> (\<nu>, ab, b) \<in> prog_sem I (Psubst a \<sigma>) \<and> ((ab, b), \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ n
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
using uadmit_prog_adjoint[OF PUA agree hpsafe ssafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>) a = prog_sem (local.adjoint I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)

goal (2 subgoals):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n
 2. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
using uadmit_prog_adjoint[OF PUA agree hpsafe ssafe good_interp] IH[OF hpsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> prog_sem (local.adjoint I \<sigma> ?\<nu>) a = prog_sem (local.adjoint I \<sigma> ?\<omega>) a
((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)

goal (1 subgoal):
 1. \<lbrakk>(\<nu>, ab, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n; \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a ^^ n); \<And>aa b ab ba. (((aa, b), ab, ba) \<in> prog_sem I (Psubst a \<sigma>)) = (((aa, b), ab, ba) \<in> prog_sem (local.adjoint I \<sigma> (aa, b)) a); ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> \<nu>) a; ((ab, b), \<omega>) \<notin> prog_sem (local.adjoint I \<sigma> (ab, b)) a\<rbrakk> \<Longrightarrow> ((ab, b), \<omega>) \<in> prog_sem (local.adjoint I \<sigma> (ab, b)) a ^^ n
[PROOF STEP]
apply (metis (no_types, lifting))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) ^^ Suc n) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ Suc n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ ?n8)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ ?n8)

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have "((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem I (Psubst a \<sigma>)) ^^ n)) = ((\<nu>, \<omega>) \<in> (\<Union> n.(prog_sem (adjoint I \<sigma> \<nu>) a)^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))
[PROOF STEP]
apply(rule UN_rule)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n b. ((\<nu>, b) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
using eachEq
[PROOF STATE]
proof (prove)
using this:
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ ?n8)

goal (1 subgoal):
 1. \<And>n b. ((\<nu>, b) \<in> prog_sem I (Psubst a \<sigma>) ^^ n) = ((\<nu>, b) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a ^^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
have eqR:"((\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) (a**)) = ((\<nu>, \<omega>) \<in> (\<Union>n. (prog_sem (adjoint I \<sigma> \<nu>) a) ^^ n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))
[PROOF STEP]
using rtrancl_is_UN_relpow
[PROOF STATE]
proof (prove)
using this:
?R\<^sup>* = \<Union> (range ((^^) ?R))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. \<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>)))))
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ ?n8)
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))
((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))
[PROOF STEP]
show "((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a**) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a**))"
[PROOF STATE]
proof (prove)
using this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>)))))
((?\<nu>8, ?\<omega>8) \<in> prog_sem I (Psubst a \<sigma>) ^^ ?n8) = ((?\<nu>8, ?\<omega>8) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>8) a ^^ ?n8)
((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem I (Psubst a \<sigma>))))) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))
((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**) = ((\<nu>, \<omega>) \<in> \<Union> (range ((^^) (prog_sem (local.adjoint I \<sigma> \<nu>) a))))

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a**)

goal (15 subgoals):
 1. \<And>\<sigma> a. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); PUadmit \<sigma> a (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
 2. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 3. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 5. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 7. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 8. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 10. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
A total of 15 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a**)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe a**; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a** \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a**)

goal (1 subgoal):
 1. hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe a** \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a** \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a**))

goal (14 subgoals):
 1. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 14 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (14 subgoals):
 1. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 14 subgoals...
[PROOF STEP]
case (Padmit_ODE \<sigma> ODE \<phi>)
[PROOF STATE]
proof (state)
this:
Oadmit \<sigma> ODE (BVO ODE)
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> (BVO ODE)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (14 subgoals):
 1. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Oadmit \<sigma> ODE (BVO ODE)
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> (BVO ODE)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have OA:"Oadmit \<sigma> ODE (BVO ODE)"
    and FA:"Fadmit \<sigma> \<phi>"
    and FUA:"FUadmit \<sigma> \<phi> (BVO ODE)"
    and IH:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> (BVO ODE)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. (Oadmit \<sigma> ODE (BVO ODE) &&& Fadmit \<sigma> \<phi>) &&& FUadmit \<sigma> \<phi> (BVO ODE) &&& (\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Oadmit \<sigma> ODE (BVO ODE)
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> (BVO ODE)
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (14 subgoals):
 1. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 14 subgoals...
[PROOF STEP]
have "hpsafe (EvolveODE ODE \<phi>) \<Longrightarrow>
     ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (EvolveODE ODE \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
proof (auto)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
fix aa ba bb
      and sol :: "real \<Rightarrow>(real, 'sz) vec"
      and t :: real
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume osafe:"osafe ODE"
[PROOF STATE]
proof (state)
this:
osafe ODE

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume t:"0 \<le> t"
[PROOF STATE]
proof (state)
this:
0 \<le> t

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume eq:"(aa,ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t)"
[PROOF STATE]
proof (state)
this:
(aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume sol:"(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t}
      {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have silly:"
      \<And>t. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
using subst_mkv[OF good_interp OA osafe ssafe, of "(sol 0, bb)" "(sol t, bb)"]
[PROOF STATE]
proof (prove)
using this:
mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (fst (sol t, bb)) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (fst (sol t, bb))

goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?t7) = mk_v (local.adjoint I \<sigma> (sol ?t7, bb)) ODE (sol 0, bb) (sol ?t7)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have hmmsubst:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,bb) (sol s, bb) (-(BVO (Osubst ODE \<sigma>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO (Osubst ODE \<sigma>))
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO (Osubst ODE \<sigma>))
[PROOF STEP]
apply (rule ODE_bound_effect[of s])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> s \<in> {0..?t}
 2. s \<in> {0..t} \<Longrightarrow> (sol solves_ode (\<lambda>_. ODE_sem ?I (Osubst ODE \<sigma>))) {0..?t} ?X
[PROOF STEP]
apply auto[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (sol solves_ode (\<lambda>_. ODE_sem ?I (Osubst ODE \<sigma>))) {0..t} ?X
[PROOF STEP]
by (rule sol)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO (Osubst ODE \<sigma>))

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sub:"(-(BVO ODE)) \<subseteq> (-(BVO (Osubst ODE \<sigma>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - BVO ODE \<subseteq> - BVO (Osubst ODE \<sigma>)
[PROOF STEP]
by(induction ODE, auto)
[PROOF STATE]
proof (state)
this:
- BVO ODE \<subseteq> - BVO (Osubst ODE \<sigma>)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have hmm:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,bb) (sol s, bb) (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)
[PROOF STEP]
using agree_sub[OF sub hmmsubst[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO ODE)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
from hmm
[PROOF STATE]
proof (chain)
picking this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO ODE)
[PROOF STEP]
have hmm':"\<And>s. s \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol s) {x. Inl x \<in> (-(BVO ODE))}"
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO ODE)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol s) {x. Inl x \<in> - BVO ODE}
[PROOF STEP]
unfolding VSagree_def Vagree_def
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, bb) $ i = fst (sol ?s7, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, bb) $ i = snd (sol ?s7, bb) $ i)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> \<forall>i\<in>{x. Inl x \<in> - BVO ODE}. sol 0 $ i = sol s $ i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol ?s7) {x. Inl x \<in> - BVO ODE}

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
note hmmm = hmmsubst
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO (Osubst ODE \<sigma>))

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
from hmmm
[PROOF STATE]
proof (chain)
picking this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO (Osubst ODE \<sigma>))
[PROOF STEP]
have hmmm':"\<And>s. s \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol s) {x. Inl x \<in> (-(BVO (Osubst ODE \<sigma>)))}"
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO (Osubst ODE \<sigma>))

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol s) {x. Inl x \<in> - BVO (Osubst ODE \<sigma>)}
[PROOF STEP]
unfolding VSagree_def Vagree_def
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO (Osubst ODE \<sigma>) \<longrightarrow> fst (sol 0, bb) $ i = fst (sol ?s7, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO (Osubst ODE \<sigma>) \<longrightarrow> snd (sol 0, bb) $ i = snd (sol ?s7, bb) $ i)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> \<forall>i\<in>{x. Inl x \<in> - BVO (Osubst ODE \<sigma>)}. sol 0 $ i = sol s $ i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol ?s7) {x. Inl x \<in> - BVO (Osubst ODE \<sigma>)}

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have Vagree_of_VSagree:"\<And>\<nu>1 \<nu>2 \<omega>1 \<omega>2 S. VSagree \<nu>1 \<nu>2 {x. Inl x \<in> S} \<Longrightarrow> VSagree \<omega>1 \<omega>2 {x. Inr x \<in> S} \<Longrightarrow> Vagree (\<nu>1, \<omega>1) (\<nu>2, \<omega>2) S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>1 \<nu>2 \<omega>1 \<omega>2 S. \<lbrakk>VSagree \<nu>1 \<nu>2 {x. Inl x \<in> S}; VSagree \<omega>1 \<omega>2 {x. Inr x \<in> S}\<rbrakk> \<Longrightarrow> Vagree (\<nu>1, \<omega>1) (\<nu>2, \<omega>2) S
[PROOF STEP]
unfolding VSagree_def Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>1 \<nu>2 \<omega>1 \<omega>2 S. \<lbrakk>\<forall>i\<in>{x. Inl x \<in> S}. \<nu>1 $ i = \<nu>2 $ i; \<forall>i\<in>{x. Inr x \<in> S}. \<omega>1 $ i = \<omega>2 $ i\<rbrakk> \<Longrightarrow> (\<forall>i. Inl i \<in> S \<longrightarrow> fst (\<nu>1, \<omega>1) $ i = fst (\<nu>2, \<omega>2) $ i) \<and> (\<forall>i. Inr i \<in> S \<longrightarrow> snd (\<nu>1, \<omega>1) $ i = snd (\<nu>2, \<omega>2) $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>VSagree ?\<nu>1.7 ?\<nu>2.7 {x. Inl x \<in> ?S7}; VSagree ?\<omega>1.7 ?\<omega>2.7 {x. Inr x \<in> ?S7}\<rbrakk> \<Longrightarrow> Vagree (?\<nu>1.7, ?\<omega>1.7) (?\<nu>2.7, ?\<omega>2.7) ?S7

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have mkv:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
by (rule silly[of s])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have lem:"\<And>ODE. Oadmit \<sigma> ODE (BVO ODE) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ODE. Oadmit \<sigma> ODE (BVO ODE) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
subgoal for ODE
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Oadmit \<sigma> ODE (BVO ODE) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
apply(induction rule: Oadmit.induct)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> c U. (\<Union>i\<in>{i |i. Inl i \<in> SIGO (OVar c)}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U
 2. \<And>\<sigma> \<theta> U x. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>\<rbrakk> \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO (OSing x \<theta>)}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U
 3. \<And>\<sigma> ODE1 U ODE2. \<lbrakk>Oadmit \<sigma> ODE1 U; (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U; Oadmit \<sigma> ODE2 U; (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE2}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U; ODE_dom (Osubst ODE1 \<sigma>) \<inter> ODE_dom (Osubst ODE2 \<sigma>) = {}\<rbrakk> \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO (OProd ODE1 ODE2)}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> \<theta> U x xa. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
subgoal for \<sigma> \<theta> U x xa
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cases "SFunctions \<sigma> xa")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U; SFunctions \<sigma> xa = None\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
unfolding TUadmit_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix a
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume un:"(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}"
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume sig:"xa \<in> SIGT \<theta>"
[PROOF STATE]
proof (state)
this:
xa \<in> SIGT \<theta>

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume some:"SFunctions \<sigma> xa = Some a"
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> xa = Some a

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume fvt:"x \<in> FVT a"
[PROOF STATE]
proof (state)
this:
x \<in> FVT a

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume xU:"x \<in> U"
[PROOF STATE]
proof (state)
this:
x \<in> U

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
from un sig
[PROOF STATE]
proof (chain)
picking this:
(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
xa \<in> SIGT \<theta>
[PROOF STEP]
have "(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}"
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
xa \<in> SIGT \<theta>

goal (1 subgoal):
 1. (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
[PROOF STEP]
have "(FVT a) \<inter> U = {}"
[PROOF STATE]
proof (prove)
using this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}

goal (1 subgoal):
 1. FVT a \<inter> U = {}
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
SFunctions \<sigma> xa = Some a

goal (1 subgoal):
 1. FVT a \<inter> U = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FVT a \<inter> U = {}

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FVT a \<inter> U = {}
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
FVT a \<inter> U = {}

goal (1 subgoal):
 1. False
[PROOF STEP]
using fvt xU
[PROOF STATE]
proof (prove)
using this:
FVT a \<inter> U = {}
x \<in> FVT a
x \<in> U

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Oadmit \<sigma> ?ODE8 (BVO ?ODE8) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ?ODE8}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ?ODE8

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have FVT_sub:"(\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
using lem[OF OA]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE

goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have agrees: "\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
using agree_sub[OF FVT_sub hmm[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s8, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have "\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (adjoint I \<sigma> (sol s, bb)) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE
[PROOF STEP]
apply (rule uadmit_mkv_adjoint)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 2. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
using agrees
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s8, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using OA hmm[of s]
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)

goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
unfolding  Vagree_def
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, bb) $ i = fst (sol s, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, bb) $ i = snd (sol s, bb) $ i)

goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using ssafe good_interp osafe
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, bb) $ i = fst (sol s, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, bb) $ i = snd (sol s, bb) $ i)
ssafe \<sigma>
is_interp I
osafe ODE

goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE
[PROOF STEP]
have mkva:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s) = mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)"
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have main_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow>  mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
using mkv mkva
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8)
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
note mkvt = main_eq[of t]
[PROOF STATE]
proof (state)
this:
t \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq1:"\<And>s. s \<in> {0..t} \<Longrightarrow>
        (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>))
      = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_vagree:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))
[PROOF STEP]
using mk_v_agree[of I "Osubst ODE \<sigma>" "(sol 0,bb)" "sol s"] osubst_eq_ODE_vars[of I ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>)) \<and> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (mk_xode I (Osubst ODE \<sigma>) (sol s)) (semBV I (Osubst ODE \<sigma>))
ODE_vars I (Osubst ODE \<sigma>) = ODE_vars (local.adjoint I \<sigma> ?\<nu>) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> fst (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = fst (sol 0, bb) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> snd (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = snd (sol 0, bb) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I (Osubst ODE \<sigma>) \<longrightarrow> fst (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = fst (mk_xode I (Osubst ODE \<sigma>) (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I (Osubst ODE \<sigma>) \<longrightarrow> snd (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = snd (mk_xode I (Osubst ODE \<sigma>) (sol s)) $ i)
ODE_vars I (Osubst ODE \<sigma>) = ODE_vars (local.adjoint I \<sigma> ?\<nu>) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> fst (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = fst (sol 0, bb) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> snd (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = snd (sol 0, bb) $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sembv_eq:"semBV I (Osubst ODE \<sigma>) = semBV (adjoint I \<sigma> (sol 0, bb)) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE
[PROOF STEP]
using subst_semBV
[PROOF STATE]
proof (prove)
using this:
semBV (local.adjoint ?I ?\<sigma> ?\<nu>') ?ODE = semBV ?I (Osubst ?ODE ?\<sigma>)

goal (1 subgoal):
 1. semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_vagree':"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV (adjoint I \<sigma> (sol 0,bb)) ODE)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE)
[PROOF STEP]
using sembv_eq fml_vagree
[PROOF STATE]
proof (prove)
using this:
semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have mysub:"-BVO ODE \<subseteq> -(semBV I (Osubst ODE \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - BVO ODE \<subseteq> - semBV I (Osubst ODE \<sigma>)
[PROOF STEP]
by(induction ODE,auto)
[PROOF STATE]
proof (state)
this:
- BVO ODE \<subseteq> - semBV I (Osubst ODE \<sigma>)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_vagree:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)
[PROOF STEP]
using agree_sub[OF mysub fml_vagree[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- BVO ODE)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_sem_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow> fml_sem (adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi> = fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi> = fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>
[PROOF STEP]
apply (rule uadmit_fml_adjoint)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> FUadmit \<sigma> \<phi> (?U s)
 2. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- ?U s)
 3. \<And>s. s \<in> {0..t} \<Longrightarrow> fsafe \<phi>
 4. \<And>s. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 5. \<And>s. s \<in> {0..t} \<Longrightarrow> is_interp I
[PROOF STEP]
using FUA fsafe ssafe  good_interp fml_vagree
[PROOF STATE]
proof (prove)
using this:
FUadmit \<sigma> \<phi> (BVO ODE)
fsafe \<phi>
ssafe \<sigma>
is_interp I
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- BVO ODE)

goal (5 subgoals):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> FUadmit \<sigma> \<phi> (?U s)
 2. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- ?U s)
 3. \<And>s. s \<in> {0..t} \<Longrightarrow> fsafe \<phi>
 4. \<And>s. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 5. \<And>s. s \<in> {0..t} \<Longrightarrow> is_interp I
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi> = fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq2:"\<And>s. s \<in> {0..t} \<Longrightarrow>
      ((mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)
      =(mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
using fml_sem_eq
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi> = fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq3:"\<And>s. s \<in> {0..t} \<Longrightarrow>
      (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (adjoint I \<sigma> (sol 0,bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
using main_eq
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq: "\<And>s. s \<in> {0..t} \<Longrightarrow>
      (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>))
       =  (mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
using fml_eq1 fml_eq2 fml_eq3
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>)
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sem_eq:"\<And>t. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (adjoint I \<sigma> (sol t, bb)) ODE (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (sol t)
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (sol t)
[PROOF STEP]
using subst_ode[OF good_interp osafe ssafe OA, of "(sol t,bb)"]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (Osubst ODE \<sigma>) (fst (sol t, bb)) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (fst (sol t, bb))

goal (1 subgoal):
 1. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
ODE_sem I (Osubst ODE \<sigma>) (sol ?t8) = ODE_sem (local.adjoint I \<sigma> (sol ?t8, bb)) ODE (sol ?t8)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sem_fact:"\<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (adjoint I \<sigma> (sol 0, bb)) ODE (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol s)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol s)
[PROOF STEP]
using subst_ode[OF good_interp osafe ssafe OA, of "(sol s, bb)"]
        uadmit_ode_adjoint'[OF ssafe good_interp agrees[of s] osafe]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (Osubst ODE \<sigma>) (fst (sol s, bb)) = ODE_sem (local.adjoint I \<sigma> (sol s, bb)) ODE (fst (sol s, bb))
s \<in> {0..t} \<Longrightarrow> ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE = ODE_sem (local.adjoint I \<sigma> (sol s, bb)) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol ?s8) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ?s8)

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol':"(sol solves_ode (\<lambda>_. ODE_sem (adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t}
       {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>_. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply (rule solves_ode_congI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (?x solves_ode ?f) ?T ?X
 2. \<And>t. t \<in> ?T \<Longrightarrow> ?x t = sol t
 3. \<And>t. t \<in> ?T \<Longrightarrow> ?f t (?x t) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (?x t)
 4. ?T = {0..t}
 5. ?X = {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply (rule sol)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol ta) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta)
 3. {0..t} = {0..t}
 4. {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)} = {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol ta) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta)
 2. {0..t} = {0..t}
 3. {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)} = {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol ta) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta)
[PROOF STEP]
by (rule sem_fact[of ta])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. {0..t} = {0..t}
 2. {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)} = {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..t} = {0..t}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)} = {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)} = {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>_. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sub:"\<And>s. s \<in> {0..t}
            \<Longrightarrow> sol s \<in> {x. (mk_v (adjoint I \<sigma> (sol 0,bb)) ODE (sol 0, bb) x \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
using fml_eq rangeI t sol solves_ode_domainD
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
?f ?x \<in> range ?f
0 \<le> t
(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
\<lbrakk>(?y solves_ode ?f) ?T ?X; ?t \<in> ?T\<rbrakk> \<Longrightarrow> ?y ?t \<in> ?X

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> sol ?s8 \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol'':"(sol solves_ode (\<lambda>c. ODE_sem (adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t}
{x. mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>c. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
apply (rule solves_odeI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol t))) {0..t}
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol t))) {0..t}
[PROOF STEP]
using sol' solves_ode_vderivD
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>_. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
(?y solves_ode ?f) ?T ?X \<Longrightarrow> (?y has_vderiv_on (\<lambda>t. ?f t (?y t))) ?T

goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol t))) {0..t}
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
using sub
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> sol ?s8 \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}

goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>c. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}

goal (2 subgoals):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
 2. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
show "\<exists>sola. sol 0 = sola 0 \<and>
      (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and>
            0 \<le> ta \<and>
            (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta}
             {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
[PROOF STEP]
apply(rule exI[where x=sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sol 0 = sol 0
 2. \<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)
 2. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
using  mkvt t
[PROOF STATE]
proof (prove)
using this:
t \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)
0 \<le> t

goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 0 \<le> t
 2. (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t
[PROOF STEP]
by (rule t)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
by (rule sol'')
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..ta} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sola 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>})

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
fix aa ba bb
      and sol::"real \<Rightarrow> (real, 'sz) vec"
      and t::real
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume osafe:"osafe ODE"
[PROOF STATE]
proof (state)
this:
osafe ODE

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume eq:"(aa,ba) = mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)"
[PROOF STATE]
proof (state)
this:
(aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume t:"0 \<le> t"
[PROOF STATE]
proof (state)
this:
0 \<le> t

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
assume sol:"(sol solves_ode (\<lambda>a. ODE_sem (adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t}
    {x. mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>}"
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have silly:"
      \<And>t. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
using subst_mkv[OF good_interp OA osafe ssafe, of "(sol 0, bb)" "(sol t, bb)"]
[PROOF STATE]
proof (prove)
using this:
mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (fst (sol t, bb)) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (fst (sol t, bb))

goal (1 subgoal):
 1. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol t, bb)) ODE (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?t7) = mk_v (local.adjoint I \<sigma> (sol ?t7, bb)) ODE (sol 0, bb) (sol ?t7)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have hmm:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,bb) (sol s, bb) (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)
[PROOF STEP]
apply (rule ODE_bound_effect[of s])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> s \<in> {0..?t}
 2. s \<in> {0..t} \<Longrightarrow> (sol solves_ode (\<lambda>_. ODE_sem ?I ODE)) {0..?t} ?X
[PROOF STEP]
apply auto[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (sol solves_ode (\<lambda>_. ODE_sem ?I ODE)) {0..t} ?X
[PROOF STEP]
by (rule sol)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO ODE)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
from hmm
[PROOF STATE]
proof (chain)
picking this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO ODE)
[PROOF STEP]
have hmm':"\<And>s. s \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol s) {x. Inl x \<in> (-(BVO ODE))}"
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s7, bb) (- BVO ODE)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol s) {x. Inl x \<in> - BVO ODE}
[PROOF STEP]
unfolding VSagree_def Vagree_def
[PROOF STATE]
proof (prove)
using this:
?s7 \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, bb) $ i = fst (sol ?s7, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, bb) $ i = snd (sol ?s7, bb) $ i)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> \<forall>i\<in>{x. Inl x \<in> - BVO ODE}. sol 0 $ i = sol s $ i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s7 \<in> {0..t} \<Longrightarrow> VSagree (sol 0) (sol ?s7) {x. Inl x \<in> - BVO ODE}

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have Vagree_of_VSagree:"\<And>\<nu>1 \<nu>2 \<omega>1 \<omega>2 S. VSagree \<nu>1 \<nu>2 {x. Inl x \<in> S} \<Longrightarrow> VSagree \<omega>1 \<omega>2 {x. Inr x \<in> S} \<Longrightarrow> Vagree (\<nu>1, \<omega>1) (\<nu>2, \<omega>2) S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>1 \<nu>2 \<omega>1 \<omega>2 S. \<lbrakk>VSagree \<nu>1 \<nu>2 {x. Inl x \<in> S}; VSagree \<omega>1 \<omega>2 {x. Inr x \<in> S}\<rbrakk> \<Longrightarrow> Vagree (\<nu>1, \<omega>1) (\<nu>2, \<omega>2) S
[PROOF STEP]
unfolding VSagree_def Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>1 \<nu>2 \<omega>1 \<omega>2 S. \<lbrakk>\<forall>i\<in>{x. Inl x \<in> S}. \<nu>1 $ i = \<nu>2 $ i; \<forall>i\<in>{x. Inr x \<in> S}. \<omega>1 $ i = \<omega>2 $ i\<rbrakk> \<Longrightarrow> (\<forall>i. Inl i \<in> S \<longrightarrow> fst (\<nu>1, \<omega>1) $ i = fst (\<nu>2, \<omega>2) $ i) \<and> (\<forall>i. Inr i \<in> S \<longrightarrow> snd (\<nu>1, \<omega>1) $ i = snd (\<nu>2, \<omega>2) $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>VSagree ?\<nu>1.7 ?\<nu>2.7 {x. Inl x \<in> ?S7}; VSagree ?\<omega>1.7 ?\<omega>2.7 {x. Inr x \<in> ?S7}\<rbrakk> \<Longrightarrow> Vagree (?\<nu>1.7, ?\<omega>1.7) (?\<nu>2.7, ?\<omega>2.7) ?S7

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have mkv:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
by (rule silly[of s])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have lem:"\<And>ODE. Oadmit \<sigma> ODE (BVO ODE) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ODE. Oadmit \<sigma> ODE (BVO ODE) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
subgoal for ODE
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Oadmit \<sigma> ODE (BVO ODE) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
apply(induction rule: Oadmit.induct)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> c U. (\<Union>i\<in>{i |i. Inl i \<in> SIGO (OVar c)}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U
 2. \<And>\<sigma> \<theta> U x. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>\<rbrakk> \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO (OSing x \<theta>)}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U
 3. \<And>\<sigma> ODE1 U ODE2. \<lbrakk>Oadmit \<sigma> ODE1 U; (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U; Oadmit \<sigma> ODE2 U; (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE2}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U; ODE_dom (Osubst ODE1 \<sigma>) \<inter> ODE_dom (Osubst ODE2 \<sigma>) = {}\<rbrakk> \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO (OProd ODE1 ODE2)}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some a \<Rightarrow> FVT a) \<subseteq> - U
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> \<theta> U x xa. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
subgoal for \<sigma> \<theta> U x xa
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cases "SFunctions \<sigma> xa")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U; SFunctions \<sigma> xa = None\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>TUadmit \<sigma> \<theta> U; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
unfolding TUadmit_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix a
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume un:"(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}"
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume sig:"xa \<in> SIGT \<theta>"
[PROOF STATE]
proof (state)
this:
xa \<in> SIGT \<theta>

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume some:"SFunctions \<sigma> xa = Some a"
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> xa = Some a

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume fvt:"x \<in> FVT a"
[PROOF STATE]
proof (state)
this:
x \<in> FVT a

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume xU:"x \<in> U"
[PROOF STATE]
proof (state)
this:
x \<in> U

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
from un sig
[PROOF STATE]
proof (chain)
picking this:
(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
xa \<in> SIGT \<theta>
[PROOF STEP]
have "(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}"
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
xa \<in> SIGT \<theta>

goal (1 subgoal):
 1. (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
[PROOF STEP]
have "(FVT a) \<inter> U = {}"
[PROOF STATE]
proof (prove)
using this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}

goal (1 subgoal):
 1. FVT a \<inter> U = {}
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
(case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}
SFunctions \<sigma> xa = Some a

goal (1 subgoal):
 1. FVT a \<inter> U = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
FVT a \<inter> U = {}

goal (1 subgoal):
 1. \<And>a. \<lbrakk>(\<Union>i\<in>SIGT \<theta>. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<inter> U = {}; TadmitF \<sigma> \<theta>; xa \<in> SIGT \<theta>; x \<in> FVT a; x \<in> U; SFunctions \<sigma> xa = Some a\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FVT a \<inter> U = {}
[PROOF STEP]
show "False"
[PROOF STATE]
proof (prove)
using this:
FVT a \<inter> U = {}

goal (1 subgoal):
 1. False
[PROOF STEP]
using fvt xU
[PROOF STATE]
proof (prove)
using this:
FVT a \<inter> U = {}
x \<in> FVT a
x \<in> U

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Oadmit \<sigma> ?ODE8 (BVO ?ODE8) \<Longrightarrow> (\<Union>i\<in>{i |i. Inl i \<in> SIGO ?ODE8}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ?ODE8

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have FVT_sub:"(\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> (-(BVO ODE))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
using lem[OF OA]
[PROOF STATE]
proof (prove)
using this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE

goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> - BVO ODE

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have agrees: "\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0,bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
using agree_sub[OF FVT_sub hmm[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s8, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have "\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (adjoint I \<sigma> (sol s, bb)) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE
[PROOF STEP]
apply (rule uadmit_mkv_adjoint)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
 2. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 3. s \<in> {0..t} \<Longrightarrow> is_interp I
 4. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
using agrees
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol ?s8, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (\<Union>i\<in>{i |i. Inl i \<in> SIGO ODE}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using OA hmm[of s]
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> Vagree (sol 0, bb) (sol s, bb) (- BVO ODE)

goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
unfolding  Vagree_def
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, bb) $ i = fst (sol s, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, bb) $ i = snd (sol s, bb) $ i)

goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
using ssafe good_interp osafe
[PROOF STATE]
proof (prove)
using this:
Oadmit \<sigma> ODE (BVO ODE)
s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - BVO ODE \<longrightarrow> fst (sol 0, bb) $ i = fst (sol s, bb) $ i) \<and> (\<forall>i. Inr i \<in> - BVO ODE \<longrightarrow> snd (sol 0, bb) $ i = snd (sol s, bb) $ i)
ssafe \<sigma>
is_interp I
osafe ODE

goal (3 subgoals):
 1. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 2. s \<in> {0..t} \<Longrightarrow> is_interp I
 3. s \<in> {0..t} \<Longrightarrow> osafe ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE
[PROOF STEP]
have mkva:"\<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s) = mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)"
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol s, bb)) ODE (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have main_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow>  mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
using mkv mkva
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8)
?s8 \<in> {0..t} \<Longrightarrow> mk_v (local.adjoint I \<sigma> (sol ?s8, bb)) ODE (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
note mkvt = main_eq[of t]
[PROOF STATE]
proof (state)
this:
t \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq1:"\<And>s. s \<in> {0..t} \<Longrightarrow>
        (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>))
      = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_vagree:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))
[PROOF STEP]
using mk_v_agree[of I "Osubst ODE \<sigma>" "(sol 0,bb)" "sol s"] osubst_eq_ODE_vars[of I ODE \<sigma>]
[PROOF STATE]
proof (prove)
using this:
Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>)) \<and> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (mk_xode I (Osubst ODE \<sigma>) (sol s)) (semBV I (Osubst ODE \<sigma>))
ODE_vars I (Osubst ODE \<sigma>) = ODE_vars (local.adjoint I \<sigma> ?\<nu>) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
using this:
((\<forall>i. Inl i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> fst (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = fst (sol 0, bb) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> snd (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = snd (sol 0, bb) $ i)) \<and> (\<forall>i. Inl i \<in> semBV I (Osubst ODE \<sigma>) \<longrightarrow> fst (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = fst (mk_xode I (Osubst ODE \<sigma>) (sol s)) $ i) \<and> (\<forall>i. Inr i \<in> semBV I (Osubst ODE \<sigma>) \<longrightarrow> snd (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = snd (mk_xode I (Osubst ODE \<sigma>) (sol s)) $ i)
ODE_vars I (Osubst ODE \<sigma>) = ODE_vars (local.adjoint I \<sigma> ?\<nu>) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> (\<forall>i. Inl i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> fst (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = fst (sol 0, bb) $ i) \<and> (\<forall>i. Inr i \<in> - semBV I (Osubst ODE \<sigma>) \<longrightarrow> snd (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) $ i = snd (sol 0, bb) $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sembv_eq:"semBV I (Osubst ODE \<sigma>) = semBV (adjoint I \<sigma> (sol 0, bb)) ODE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE
[PROOF STEP]
using subst_semBV
[PROOF STATE]
proof (prove)
using this:
semBV (local.adjoint ?I ?\<sigma> ?\<nu>') ?ODE = semBV ?I (Osubst ?ODE ?\<sigma>)

goal (1 subgoal):
 1. semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_vagree':"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV (adjoint I \<sigma> (sol 0,bb)) ODE)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE)
[PROOF STEP]
using sembv_eq fml_vagree
[PROOF STATE]
proof (prove)
using this:
semBV I (Osubst ODE \<sigma>) = semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- semBV I (Osubst ODE \<sigma>))

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- semBV (local.adjoint I \<sigma> (sol 0, bb)) ODE)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have mysub:"-BVO ODE \<subseteq> -(semBV I (Osubst ODE \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - BVO ODE \<subseteq> - semBV I (Osubst ODE \<sigma>)
[PROOF STEP]
by(induction ODE,auto)
[PROOF STATE]
proof (state)
this:
- BVO ODE \<subseteq> - semBV I (Osubst ODE \<sigma>)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_vagree:"\<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)
[PROOF STEP]
using agree_sub[OF mysub fml_vagree[of s]]
[PROOF STATE]
proof (prove)
using this:
s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- BVO ODE)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- BVO ODE)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_sem_eq:"\<And>s. s \<in> {0..t} \<Longrightarrow> fml_sem (adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi> = fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi> = fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>
[PROOF STEP]
apply (rule uadmit_fml_adjoint)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> FUadmit \<sigma> \<phi> (?U s)
 2. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- ?U s)
 3. \<And>s. s \<in> {0..t} \<Longrightarrow> fsafe \<phi>
 4. \<And>s. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 5. \<And>s. s \<in> {0..t} \<Longrightarrow> is_interp I
[PROOF STEP]
using FUA fsafe ssafe  good_interp fml_vagree
[PROOF STATE]
proof (prove)
using this:
FUadmit \<sigma> \<phi> (BVO ODE)
fsafe \<phi>
ssafe \<sigma>
is_interp I
?s8 \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8)) (sol 0, bb) (- BVO ODE)

goal (5 subgoals):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> FUadmit \<sigma> \<phi> (?U s)
 2. \<And>s. s \<in> {0..t} \<Longrightarrow> Vagree (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s)) (sol 0, bb) (- ?U s)
 3. \<And>s. s \<in> {0..t} \<Longrightarrow> fsafe \<phi>
 4. \<And>s. s \<in> {0..t} \<Longrightarrow> ssafe \<sigma>
 5. \<And>s. s \<in> {0..t} \<Longrightarrow> is_interp I
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi> = fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq2:"\<And>s. s \<in> {0..t} \<Longrightarrow>
      ((mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>)
      =(mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
using fml_sem_eq
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi> = fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq3:"\<And>s. s \<in> {0..t} \<Longrightarrow>
        (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (adjoint I \<sigma> (sol 0,bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>) "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
using main_eq
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have fml_eq: "\<And>s. s \<in> {0..t} \<Longrightarrow>
         (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>))
          =  (mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
using fml_eq1 fml_eq2 fml_eq3
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>)
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8))) \<phi>) = (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol s) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sem_eq:"\<And>t. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (adjoint I \<sigma> (sol t, bb)) ODE (sol t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>t. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (sol t)
[PROOF STEP]
subgoal for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (sol t)
[PROOF STEP]
using subst_ode[OF good_interp osafe ssafe OA, of "(sol t,bb)"]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (Osubst ODE \<sigma>) (fst (sol t, bb)) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (fst (sol t, bb))

goal (1 subgoal):
 1. ODE_sem I (Osubst ODE \<sigma>) (sol t) = ODE_sem (local.adjoint I \<sigma> (sol t, bb)) ODE (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
ODE_sem I (Osubst ODE \<sigma>) (sol ?t8) = ODE_sem (local.adjoint I \<sigma> (sol ?t8, bb)) ODE (sol ?t8)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sem_fact:"\<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (adjoint I \<sigma> (sol 0, bb)) ODE (sol s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol s)
[PROOF STEP]
subgoal for s
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol s)
[PROOF STEP]
using subst_ode[OF good_interp osafe ssafe OA, of "(sol s, bb)"]
        uadmit_ode_adjoint'[OF ssafe good_interp agrees[of s] osafe]
[PROOF STATE]
proof (prove)
using this:
ODE_sem I (Osubst ODE \<sigma>) (fst (sol s, bb)) = ODE_sem (local.adjoint I \<sigma> (sol s, bb)) ODE (fst (sol s, bb))
s \<in> {0..t} \<Longrightarrow> ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE = ODE_sem (local.adjoint I \<sigma> (sol s, bb)) ODE

goal (1 subgoal):
 1. s \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol s) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol ?s8) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ?s8)

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sub:"\<And>s. s \<in> {0..t}
            \<Longrightarrow> sol s \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
using fml_eq rangeI t sol solves_ode_domainD
[PROOF STATE]
proof (prove)
using this:
?s8 \<in> {0..t} \<Longrightarrow> (mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol ?s8) \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>)
?f ?x \<in> range ?f
0 \<le> t
(sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
\<lbrakk>(?y solves_ode ?f) ?T ?X; ?t \<in> ?T\<rbrakk> \<Longrightarrow> ?y ?t \<in> ?X

goal (1 subgoal):
 1. \<And>s. s \<in> {0..t} \<Longrightarrow> sol s \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol s) \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?s8 \<in> {0..t} \<Longrightarrow> sol ?s8 \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ?s8) \<in> fml_sem I (Fsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol':"(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (adjoint I \<sigma> (sol 0, bb)) \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
apply (rule solves_ode_congI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (?x solves_ode ?f) ?T ?X
 2. \<And>t. t \<in> ?T \<Longrightarrow> ?x t = sol t
 3. \<And>t. t \<in> ?T \<Longrightarrow> ?f t (?x t) = ODE_sem I (Osubst ODE \<sigma>) (?x t)
 4. ?T = {0..t}
 5. ?X = {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
apply (rule sol)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta) = ODE_sem I (Osubst ODE \<sigma>) (sol ta)
 3. {0..t} = {0..t}
 4. {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>} = {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta = sol ta
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta) = ODE_sem I (Osubst ODE \<sigma>) (sol ta)
 2. {0..t} = {0..t}
 3. {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>} = {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta) = ODE_sem I (Osubst ODE \<sigma>) (sol ta)
[PROOF STEP]
using sem_fact[of ta]
[PROOF STATE]
proof (prove)
using this:
ta \<in> {0..t} \<Longrightarrow> ODE_sem I (Osubst ODE \<sigma>) (sol ta) = ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta)

goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol ta) = ODE_sem I (Osubst ODE \<sigma>) (sol ta)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. {0..t} = {0..t}
 2. {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>} = {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..t} = {0..t}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>} = {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>} = {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
have sol'':"(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply (rule solves_odeI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I (Osubst ODE \<sigma>) (sol t))) {0..t}
 2. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I (Osubst ODE \<sigma>) (sol t))) {0..t}
[PROOF STEP]
using sol' solves_ode_vderivD
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}
(?y solves_ode ?f) ?T ?X \<Longrightarrow> (?y has_vderiv_on (\<lambda>t. ?f t (?y t))) ?T

goal (1 subgoal):
 1. (sol has_vderiv_on (\<lambda>t. ODE_sem I (Osubst ODE \<sigma>) (sol t))) {0..t}
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ta. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal for ta
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
using sub[of ta]
[PROOF STATE]
proof (prove)
using this:
ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ta) \<in> fml_sem I (Fsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. ta \<in> {0..t} \<Longrightarrow> sol ta \<in> {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sol ta \<in> (if mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ta) \<in> fml_sem I (Fsubst \<phi> \<sigma>) then UNIV else {}); 0 \<le> ta; ta \<le> t\<rbrakk> \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ta) \<in> fml_sem I (Fsubst \<phi> \<sigma>)
[PROOF STEP]
by (meson empty_iff)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. \<And>aa ba bb sol t. \<lbrakk>ssafe \<sigma>; osafe ODE; fsafe \<phi>; (aa, ba) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t); 0 \<le> t; (sol solves_ode (\<lambda>a. ODE_sem (local.adjoint I \<sigma> (sol 0, bb)) ODE)) {0..t} {x. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) x \<in> fml_sem (local.adjoint I \<sigma> (sol 0, bb)) \<phi>}\<rbrakk> \<Longrightarrow> \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
show "\<exists>sola. sol 0 = sola 0 \<and>
        (\<exists>ta. mk_v (adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and>
              0 \<le> ta \<and>
              (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
apply(rule exI[where x=sol])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sol 0 = sol 0
 2. \<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sol 0 = sol 0
[PROOF STEP]
by (rule refl)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol ta) \<and> 0 \<le> ta \<and> (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply(rule exI[where x=t])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) \<and> 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t)
 2. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t)
[PROOF STEP]
using  mkvt t
[PROOF STATE]
proof (prove)
using this:
t \<in> {0..t} \<Longrightarrow> mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t) = mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t)
0 \<le> t

goal (1 subgoal):
 1. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sol 0, bb) (sol t)
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 0 \<le> t
 2. (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t
[PROOF STEP]
by (rule t)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
using sol''
[PROOF STATE]
proof (prove)
using this:
(sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}

goal (1 subgoal):
 1. (sol solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..t} {x. mk_v I (Osubst ODE \<sigma>) (sol 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)}
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<exists>sola. sol 0 = sola 0 \<and> (\<exists>ta. mk_v (local.adjoint I \<sigma> (sol 0, bb)) ODE (sol 0, bb) (sol t) = mk_v I (Osubst ODE \<sigma>) (sola 0, bb) (sola ta) \<and> 0 \<le> ta \<and> (sola solves_ode (\<lambda>a. ODE_sem I (Osubst ODE \<sigma>))) {0..ta} {x. mk_v I (Osubst ODE \<sigma>) (sola 0, bb) x \<in> fml_sem I (Fsubst \<phi> \<sigma>)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (EvolveODE ODE \<phi>))

goal (14 subgoals):
 1. \<And>\<sigma> ODE \<phi>. \<lbrakk>Oadmit \<sigma> ODE (BVO ODE); Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> (BVO ODE)\<rbrakk> \<Longrightarrow> hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
 2. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 4. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 6. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 7. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 9. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 10. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
A total of 14 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (EvolveODE ODE \<phi>))
[PROOF STEP]
show "?case"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (EvolveODE ODE \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (EvolveODE ODE \<phi>))

goal (1 subgoal):
 1. hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (EvolveODE ODE \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (EvolveODE ODE \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (EvolveODE ODE \<phi>)))

goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 13 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 13 subgoals...
[PROOF STEP]
case (Padmit_Choice \<sigma> a b)
[PROOF STATE]
proof (state)
this:
Padmit \<sigma> a
Padmit \<sigma> b
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))

goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 13 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Padmit \<sigma> a
Padmit \<sigma> b
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))
[PROOF STEP]
have IH1:"hpsafe a \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))"
    and IH2:"hpsafe b \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))"
[PROOF STATE]
proof (prove)
using this:
Padmit \<sigma> a
Padmit \<sigma> b
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))

goal (1 subgoal):
 1. (\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))) &&& (\<lbrakk>hpsafe b; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b)))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
\<lbrakk>hpsafe b; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst b \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) b)

goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 13 subgoals...
[PROOF STEP]
have hpsafe1:"hpsafe (a \<union>\<union> b) \<Longrightarrow> hpsafe a"
    and hpsafe2:"hpsafe (a \<union>\<union> b) \<Longrightarrow> hpsafe b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (hpsafe (a \<union>\<union> b) \<Longrightarrow> hpsafe a) &&& (hpsafe (a \<union>\<union> b) \<Longrightarrow> hpsafe b)
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
hpsafe (a \<union>\<union> b) \<Longrightarrow> hpsafe a
hpsafe (a \<union>\<union> b) \<Longrightarrow> hpsafe b

goal (13 subgoals):
 1. \<And>\<sigma> a b. \<lbrakk>Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); Padmit \<sigma> b; hpsafe b \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst b \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) b))\<rbrakk> \<Longrightarrow> hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 3. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 5. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 6. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 8. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 9. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 10. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
A total of 13 subgoals...
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
[PROOF STEP]
using IH1[OF hpsafe1] IH2[OF hpsafe2]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (a \<union>\<union> b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
\<lbrakk>hpsafe (a \<union>\<union> b); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst b \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) b)

goal (1 subgoal):
 1. hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (a \<union>\<union> b) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (a \<union>\<union> b) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (a \<union>\<union> b)))

goal (12 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 5. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 5. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
case (Padmit_Assign \<sigma> \<theta> x)
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> \<theta>

goal (12 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 5. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Tadmit \<sigma> \<theta>
[PROOF STEP]
have TA:"Tadmit \<sigma> \<theta>"
[PROOF STATE]
proof (prove)
using this:
Tadmit \<sigma> \<theta>

goal (1 subgoal):
 1. Tadmit \<sigma> \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> \<theta>

goal (12 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 5. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
have "hpsafe (Assign x \<theta>) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow>  (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (Assign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) (Assign x \<theta>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
assume hpsafe:"hpsafe (Assign x \<theta>)"
[PROOF STATE]
proof (state)
this:
hpsafe (x := \<theta>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
from ssafe
[PROOF STATE]
proof (chain)
picking this:
ssafe \<sigma>
[PROOF STEP]
have ssafes:"(\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f')"
        "(\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')"
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?i8 = Some ?f'8 \<Longrightarrow> dfree ?f'8
SPredicates \<sigma> ?f8 = Some ?f'8 \<Longrightarrow> fsafe ?f'8

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
from hpsafe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (x := \<theta>)
[PROOF STEP]
have dsafe:"dsafe \<theta>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (x := \<theta>)

goal (1 subgoal):
 1. dsafe \<theta>
[PROOF STEP]
by (auto elim: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe \<theta>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
show "?thesis \<nu> \<omega>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>))
[PROOF STEP]
using subst_dterm[OF good_interp TA dsafe ssafes]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i18 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f9 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst \<theta> \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) \<theta> ?\<nu>

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (x := \<theta>))

goal (12 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
 2. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 4. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 5. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 7. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 8. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 9. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 10. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
A total of 12 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (x := \<theta>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (x := \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (x := \<theta>))

goal (1 subgoal):
 1. hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (x := \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (x := \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (x := \<theta>)))

goal (11 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 4. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 4. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
case (Padmit_DiffAssign \<sigma> \<theta> x)
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> \<theta>

goal (11 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 4. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Tadmit \<sigma> \<theta>
[PROOF STEP]
have TA:"Tadmit \<sigma> \<theta>"
[PROOF STATE]
proof (prove)
using this:
Tadmit \<sigma> \<theta>

goal (1 subgoal):
 1. Tadmit \<sigma> \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> \<theta>

goal (11 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 4. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
have "hpsafe (DiffAssign x \<theta>) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow>  (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
assume hpsafe:"hpsafe (DiffAssign x \<theta>)"
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x \<theta>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
from ssafe
[PROOF STATE]
proof (chain)
picking this:
ssafe \<sigma>
[PROOF STEP]
have ssafes:"(\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f')"
        "(\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')"
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?i8 = Some ?f'8 \<Longrightarrow> dfree ?f'8
SPredicates \<sigma> ?f8 = Some ?f'8 \<Longrightarrow> fsafe ?f'8

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
from hpsafe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (DiffAssign x \<theta>)
[PROOF STEP]
have dsafe:"dsafe \<theta>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (DiffAssign x \<theta>)

goal (1 subgoal):
 1. dsafe \<theta>
[PROOF STEP]
by (auto elim: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe \<theta>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
show "?thesis \<nu> \<omega>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>))
[PROOF STEP]
using subst_dterm[OF good_interp TA dsafe ssafes]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i18 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f9 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst \<theta> \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) \<theta> ?\<nu>

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (DiffAssign x \<theta>))

goal (11 subgoals):
 1. \<And>\<sigma> \<theta> x. Tadmit \<sigma> \<theta> \<Longrightarrow> hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 3. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 4. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 6. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 7. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 8. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 9. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 10. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
A total of 11 subgoals...
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (DiffAssign x \<theta>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (DiffAssign x \<theta>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (DiffAssign x \<theta>))

goal (1 subgoal):
 1. hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (DiffAssign x \<theta>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (DiffAssign x \<theta>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (DiffAssign x \<theta>)))

goal (10 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 2. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 3. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (10 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 2. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 3. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Padmit_Test \<sigma> \<phi>)
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (10 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 2. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 3. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have IH:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (10 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 2. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 3. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "hpsafe (? \<phi>) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
assume hpsafe:"hpsafe (? \<phi>)"
[PROOF STATE]
proof (state)
this:
hpsafe (? \<phi>)

goal (1 subgoal):
 1. \<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
from hpsafe
[PROOF STATE]
proof (chain)
picking this:
hpsafe (? \<phi>)
[PROOF STEP]
have fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
hpsafe (? \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: hpsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
fix \<nu> \<omega>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
show "?thesis \<nu> \<omega>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>))
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (? \<phi>))

goal (10 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
 2. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 3. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 5. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 6. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 7. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 8. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 9. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 10. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (? \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>hpsafe (? \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) (? \<phi>))

goal (1 subgoal):
 1. hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
hpsafe (? \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst (? \<phi>) \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) (? \<phi>)))

goal (9 subgoals):
 1. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 2. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 2. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Geq \<sigma> \<theta>1 \<theta>2)
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> \<theta>1
Tadmit \<sigma> \<theta>2

goal (9 subgoals):
 1. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 2. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Tadmit \<sigma> \<theta>1
Tadmit \<sigma> \<theta>2
[PROOF STEP]
have TA1:"Tadmit \<sigma> \<theta>1" and TA2:"Tadmit \<sigma> \<theta>2"
[PROOF STATE]
proof (prove)
using this:
Tadmit \<sigma> \<theta>1
Tadmit \<sigma> \<theta>2

goal (1 subgoal):
 1. Tadmit \<sigma> \<theta>1 &&& Tadmit \<sigma> \<theta>2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> \<theta>1
Tadmit \<sigma> \<theta>2

goal (9 subgoals):
 1. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 2. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (Geq \<theta>1 \<theta>2) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
assume fsafe:"fsafe (Geq \<theta>1 \<theta>2)"
[PROOF STATE]
proof (state)
this:
fsafe (Geq \<theta>1 \<theta>2)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe (Geq \<theta>1 \<theta>2)
[PROOF STEP]
have dsafe1:"dsafe \<theta>1" and dsafe2:"dsafe \<theta>2"
[PROOF STATE]
proof (prove)
using this:
fsafe (Geq \<theta>1 \<theta>2)

goal (1 subgoal):
 1. dsafe \<theta>1 &&& dsafe \<theta>2
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
dsafe \<theta>1
dsafe \<theta>2

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
from ssafe
[PROOF STATE]
proof (chain)
picking this:
ssafe \<sigma>
[PROOF STEP]
have ssafes:"(\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f')"
      "(\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')"
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?i8 = Some ?f'8 \<Longrightarrow> dfree ?f'8
SPredicates \<sigma> ?f8 = Some ?f'8 \<Longrightarrow> fsafe ?f'8

goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
using
      subst_dterm[OF good_interp TA1 dsafe1 ssafes]
      subst_dterm[OF good_interp TA2 dsafe2 ssafes]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i18 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f9 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst \<theta>1 \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) \<theta>1 ?\<nu>
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i18 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f9 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst \<theta>2 \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) \<theta>2 ?\<nu>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (Geq \<theta>1 \<theta>2))

goal (9 subgoals):
 1. \<And>\<sigma> \<theta>1 \<theta>2. \<lbrakk>Tadmit \<sigma> \<theta>1; Tadmit \<sigma> \<theta>2\<rbrakk> \<Longrightarrow> fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
 2. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 4. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 5. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 6. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 7. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 8. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 9. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (Geq \<theta>1 \<theta>2))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (Geq \<theta>1 \<theta>2); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (Geq \<theta>1 \<theta>2))

goal (1 subgoal):
 1. fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (Geq \<theta>1 \<theta>2) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Geq \<theta>1 \<theta>2) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Geq \<theta>1 \<theta>2)))

goal (8 subgoals):
 1. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Prop1 \<sigma> args p p')
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = Some p'
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'
dsafe (Tsubst (args ?i7) \<sigma>)

goal (8 subgoals):
 1. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = Some p'
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'
dsafe (Tsubst (args ?i7) \<sigma>)
[PROOF STEP]
have TA:"\<And>i. Tadmit \<sigma> (args i)"
    and some:"SPredicates \<sigma> p = Some p'"
    and NFA:"NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'"
    and substSafes:"\<And>i. dsafe (Tsubst (args i) \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = Some p'
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'
dsafe (Tsubst (args ?i7) \<sigma>)

goal (1 subgoal):
 1. ((\<And>i. Tadmit \<sigma> (args i)) &&& SPredicates \<sigma> p = Some p') &&& NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p' &&& (\<And>i. dsafe (Tsubst (args i) \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = Some p'
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'
dsafe (Tsubst (args ?i7) \<sigma>)

goal (8 subgoals):
 1. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe ($\<phi> p args) \<Longrightarrow>
         ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
assume fsafe:"fsafe ($\<phi> p args)"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
from ssafe
[PROOF STATE]
proof (chain)
picking this:
ssafe \<sigma>
[PROOF STEP]
have ssafes:"(\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f')"
      "(\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')"
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?i8 = Some ?f'8 \<Longrightarrow> dfree ?f'8
SPredicates \<sigma> ?f8 = Some ?f'8 \<Longrightarrow> fsafe ?f'8

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> p args)
[PROOF STEP]
have safes:"\<And>i. dsafe (args i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i8)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have IH:"(\<And>\<nu>'. \<And>i. dsafe (args i) \<Longrightarrow>
          dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (adjoint I \<sigma> \<nu>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>' i. dsafe (args i) \<Longrightarrow> dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
using  subst_dterm[OF good_interp TA safes ssafes]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i18 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f9 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst (args ?i27) \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) (args ?i27) ?\<nu>

goal (1 subgoal):
 1. \<And>\<nu>' i. dsafe (args i) \<Longrightarrow> dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i8) \<Longrightarrow> dterm_sem I (Tsubst (args ?i8) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i8) \<nu>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have eqs:"\<And>i \<nu>'. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (adjoint I \<sigma> \<nu>) (args i) \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i \<nu>'. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by (auto simp add: IH safes)
[PROOF STATE]
proof (state)
this:
dterm_sem I (Tsubst (args ?i9) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i9) \<nu>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
let ?sub = "(\<lambda> i. Tsubst (args i) \<sigma>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have freef:"fsafe p'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe p'
[PROOF STEP]
using ssafe some
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>
SPredicates \<sigma> p = Some p'

goal (1 subgoal):
 1. fsafe p'
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')
SPredicates \<sigma> p = Some p'

goal (1 subgoal):
 1. fsafe p'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe p'

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have IH2:"(\<nu> \<in> fml_sem I (FsubstFO p' ?sub)) = (\<nu> \<in> fml_sem (adjointFO I ?sub \<nu>) p')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO p' (\<lambda>i. Tsubst (args i) \<sigma>))) = (\<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p')
[PROOF STEP]
using nsubst_fml good_interp NFA freef substSafes
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>is_interp ?I; NFadmit ?\<sigma> ?\<phi>; fsafe ?\<phi>; \<forall>i. dsafe (?\<sigma> i)\<rbrakk> \<Longrightarrow> (?\<nu> \<in> fml_sem ?I (FsubstFO ?\<phi> ?\<sigma>)) = (?\<nu> \<in> fml_sem (adjointFO ?I ?\<sigma> ?\<nu>) ?\<phi>)
is_interp I
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'
fsafe p'
dsafe (Tsubst (args ?i7) \<sigma>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO p' (\<lambda>i. Tsubst (args i) \<sigma>))) = (\<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO p' (\<lambda>i. Tsubst (args i) \<sigma>))) = (\<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p')

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have vec:"(\<chi> i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi> i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
[PROOF STEP]
apply(auto simp add: vec_eq_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
subgoal for i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
using IH[of i, OF safes[of i]]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>

goal (1 subgoal):
 1. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))
[PROOF STEP]
using IH safes eqs
[PROOF STATE]
proof (prove)
using this:
dsafe (args ?i8) \<Longrightarrow> dterm_sem I (Tsubst (args ?i8) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i8) \<nu>
dsafe (args ?i8)
dterm_sem I (Tsubst (args ?i9) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i9) \<nu>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))
[PROOF STEP]
apply (auto simp add:  IH2  some good_interp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'\<rbrakk> \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
 2. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = Some p'

goal (2 subgoals):
 1. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'\<rbrakk> \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
 2. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'
[PROOF STEP]
unfolding adjoint_def adjointFO_def
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = Some p'

goal (2 subgoals):
 1. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>; \<nu> \<in> fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (Tsubst (args f') \<sigma>) \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> p'\<rbrakk> \<Longrightarrow> Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> p (\<chi>i. dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>)
 2. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>; Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> p (\<chi>i. dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (Tsubst (args f') \<sigma>) \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> p'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))

goal (8 subgoals):
 1. \<And>\<sigma> args p p'. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = Some p'; NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'; \<And>i. dsafe (Tsubst (args i) \<sigma>)\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 3. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 4. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 5. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 6. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 7. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 8. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))
[PROOF STEP]
show "?case"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))

goal (1 subgoal):
 1. fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))

goal (7 subgoals):
 1. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 3. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 4. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 3. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 4. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Prop2 \<sigma> args p)
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = None

goal (7 subgoals):
 1. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 3. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 4. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
note TA = Fadmit_Prop2.hyps(1)
    and none = Fadmit_Prop2.hyps(2)
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = None

goal (7 subgoals):
 1. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 3. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 4. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (Prop p args) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>.(\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
assume safe:"fsafe (Prop p args)" and ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args)
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
from ssafe
[PROOF STATE]
proof (chain)
picking this:
ssafe \<sigma>
[PROOF STEP]
have ssafes:"(\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f')"
        "(\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')"
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?i7 = Some ?f'7 \<Longrightarrow> dfree ?f'7
SPredicates \<sigma> ?f7 = Some ?f'7 \<Longrightarrow> fsafe ?f'7

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> p args)
[PROOF STEP]
have  safes:"\<And>i. dsafe (args i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have IH:"(\<And>\<nu>'. \<And>i. dsafe (args i) \<Longrightarrow>
        dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (adjoint I \<sigma> \<nu>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>' i. dsafe (args i) \<Longrightarrow> dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
using  subst_dterm[OF good_interp TA safes ssafes]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i16 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f8 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst (args ?i24) \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) (args ?i24) ?\<nu>

goal (1 subgoal):
 1. \<And>\<nu>' i. dsafe (args i) \<Longrightarrow> dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i7) \<Longrightarrow> dterm_sem I (Tsubst (args ?i7) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i7) \<nu>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have Ieq:"Predicates I p = Predicates (adjoint I \<sigma> \<nu>) p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Predicates I p = Predicates (local.adjoint I \<sigma> \<nu>) p
[PROOF STEP]
using none
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = None

goal (1 subgoal):
 1. Predicates I p = Predicates (local.adjoint I \<sigma> \<nu>) p
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = None

goal (1 subgoal):
 1. Predicates I p = Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Predicates I p = Predicates (local.adjoint I \<sigma> \<nu>) p

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have vec:"(\<chi> i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi> i. dterm_sem (adjoint I \<sigma> \<nu>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
[PROOF STEP]
apply(auto simp add: vec_eq_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
subgoal for i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
using IH[of i, OF safes[of i]]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>

goal (1 subgoal):
 1. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))
[PROOF STEP]
using none IH Ieq vec
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = None
dsafe (args ?i7) \<Longrightarrow> dterm_sem I (Tsubst (args ?i7) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i7) \<nu>
Predicates I p = Predicates (local.adjoint I \<sigma> \<nu>) p
(\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))

goal (7 subgoals):
 1. \<And>\<sigma> args p. \<lbrakk>\<And>i. Tadmit \<sigma> (args i); SPredicates \<sigma> p = None\<rbrakk> \<Longrightarrow> fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
 2. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 3. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 4. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 5. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 6. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 7. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))
[PROOF STEP]
show "?case"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))

goal (1 subgoal):
 1. fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))

goal (6 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 2. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 3. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 4. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 5. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 2. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 3. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 4. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 5. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Not \<sigma> \<phi>)
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (6 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 2. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 3. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 4. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 5. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have IH:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (6 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 2. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 3. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 4. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 5. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have fsafe:"fsafe (Not \<phi>) \<Longrightarrow> fsafe \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe (! \<phi>) \<Longrightarrow> fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe (! \<phi>) \<Longrightarrow> fsafe \<phi>

goal (6 subgoals):
 1. \<And>\<sigma> \<phi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))\<rbrakk> \<Longrightarrow> fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
 2. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 3. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 4. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 5. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 6. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
[PROOF STEP]
using IH[OF fsafe]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (! \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (! \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (! \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (! \<phi>)))

goal (5 subgoals):
 1. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 2. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 3. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 4. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 2. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 3. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 4. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_And \<sigma> \<phi> \<psi>)
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
Fadmit \<sigma> \<psi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))

goal (5 subgoals):
 1. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 2. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 3. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 4. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
Fadmit \<sigma> \<psi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))
[PROOF STEP]
have IH1:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
      and IH2:"fsafe \<psi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
Fadmit \<sigma> \<psi>
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))

goal (1 subgoal):
 1. (\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))) &&& (\<lbrakk>fsafe \<psi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>)))
[PROOF STEP]
by (blast)+
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
\<lbrakk>fsafe \<psi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<psi>)

goal (5 subgoals):
 1. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 2. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 3. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 4. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have fsafe1:"fsafe (\<phi> && \<psi>) \<Longrightarrow> fsafe \<phi>" and fsafe2:"fsafe (\<phi> && \<psi>) \<Longrightarrow> fsafe \<psi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (fsafe (\<phi> && \<psi>) \<Longrightarrow> fsafe \<phi>) &&& (fsafe (\<phi> && \<psi>) \<Longrightarrow> fsafe \<psi>)
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe (\<phi> && \<psi>) \<Longrightarrow> fsafe \<phi>
fsafe (\<phi> && \<psi>) \<Longrightarrow> fsafe \<psi>

goal (5 subgoals):
 1. \<And>\<sigma> \<phi> \<psi>. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Fadmit \<sigma> \<psi>; fsafe \<psi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<psi>))\<rbrakk> \<Longrightarrow> fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
 2. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 3. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 4. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 5. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
[PROOF STEP]
using IH1[OF fsafe1] IH2[OF fsafe2]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (\<phi> && \<psi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
\<lbrakk>fsafe (\<phi> && \<psi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<psi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<psi>)

goal (1 subgoal):
 1. fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (\<phi> && \<psi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<phi> && \<psi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<phi> && \<psi>)))

goal (4 subgoals):
 1. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 2. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 3. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 4. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 2. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 3. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 4. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Exists \<sigma> \<phi> x)
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> {Inl x}
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (4 subgoals):
 1. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 2. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 3. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 4. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> {Inl x}
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have IH:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
    and FUA:"FUadmit \<sigma> \<phi> {Inl x}"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> {Inl x}
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. (\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))) &&& FUadmit \<sigma> \<phi> {Inl x}
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
FUadmit \<sigma> \<phi> {Inl x}

goal (4 subgoals):
 1. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 2. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 3. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 4. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have fsafe:"fsafe (Exists x \<phi>) \<Longrightarrow> fsafe \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe (Exists x \<phi>) \<Longrightarrow> fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe (Exists x \<phi>) \<Longrightarrow> fsafe \<phi>

goal (4 subgoals):
 1. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 2. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 3. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 4. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have eq:"fsafe (Exists x \<phi>) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst  (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>)  (Exists x \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
assume fsafe:"fsafe (Exists x \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (Exists x \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe (Exists x \<phi>)
[PROOF STEP]
have fsafe':"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
fsafe (Exists x \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have agree:"\<And>r. Vagree \<nu> (repv \<nu> x r) (- {Inl x})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>r. Vagree \<nu> (repv \<nu> x r) (- {Inl x})
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>r. (\<forall>i. Inl i \<in> - {Inl x} \<longrightarrow> fst \<nu> $ i = fst (repv \<nu> x r) $ i) \<and> (\<forall>i. Inr i \<in> - {Inl x} \<longrightarrow> snd \<nu> $ i = snd (repv \<nu> x r) $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> (repv \<nu> x ?r7) (- {Inl x})

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have sem_eq:"\<And>r. ((repv \<nu> x r) \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) =
                      ((repv \<nu> x r) \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>r. (repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using uadmit_fml_adjoint[OF FUA agree fsafe' ssafe good_interp]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> (repv \<nu> x ?r8)) \<phi>

goal (1 subgoal):
 1. \<And>r. (repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(repv \<nu> x ?r7 \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x ?r7)) \<phi>) = (repv \<nu> x ?r7 \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "(\<nu> \<in> fml_sem I (Fsubst  (Exists x \<phi>) \<sigma>)) = (\<exists>r. (repv \<nu> x r) \<in> fml_sem I (Fsubst \<phi> \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "... = (\<exists>r. (repv \<nu> x r) \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)
[PROOF STEP]
using IH[OF fsafe' ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "... = (\<exists>r. (repv \<nu> x r) \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using sem_eq
[PROOF STATE]
proof (prove)
using this:
(repv \<nu> x ?r7 \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x ?r7)) \<phi>) = (repv \<nu> x ?r7 \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (adjoint I \<sigma> \<nu>) (Exists x \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>))
(\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>))
[PROOF STEP]
show "(\<nu> \<in> fml_sem I (Fsubst  (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>)  (Exists x \<phi>))"
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>))
(\<exists>r. repv \<nu> x r \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> (repv \<nu> x r)) \<phi>) = (\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
(\<exists>r. repv \<nu> x r \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>))

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (Exists x \<phi>))

goal (4 subgoals):
 1. \<And>\<sigma> \<phi> x. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> {Inl x}\<rbrakk> \<Longrightarrow> fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
 2. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 3. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 4. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (Exists x \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (Exists x \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (Exists x \<phi>))

goal (1 subgoal):
 1. fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (Exists x \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (Exists x \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (Exists x \<phi>)))

goal (3 subgoals):
 1. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 2. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 3. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 2. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 3. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Diamond \<sigma> \<phi> a)
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
Padmit \<sigma> a
FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))

goal (3 subgoals):
 1. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 2. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 3. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
Padmit \<sigma> a
FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))
[PROOF STEP]
have PA:"Padmit \<sigma> a"
      and FUA:"FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>))"
      and IH1:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjoint I \<sigma> \<nu>) \<phi>))"
      and IH2:"hpsafe a \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) a))"
      and substSafe:"hpsafe (Psubst a \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
Padmit \<sigma> a
FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>))
hpsafe (Psubst a \<sigma>)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))

goal (1 subgoal):
 1. (Padmit \<sigma> a &&& FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>))) &&& (\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))) &&& (\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a))) &&& hpsafe (Psubst a \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Padmit \<sigma> a
FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>))
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
hpsafe (Psubst a \<sigma>)

goal (3 subgoals):
 1. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 2. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 3. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (\<langle> a \<rangle> \<phi>) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
assume fsafe:"fsafe (\<langle> a \<rangle> \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (\<langle> a \<rangle> \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe (\<langle> a \<rangle> \<phi>)
[PROOF STEP]
have fsafe':"fsafe \<phi>" and hpsafe:"hpsafe a"
[PROOF STATE]
proof (prove)
using this:
fsafe (\<langle> a \<rangle> \<phi>)

goal (1 subgoal):
 1. fsafe \<phi> &&& hpsafe a
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>
hpsafe a

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have agree:"\<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<omega> (-BVP(Psubst a \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<omega> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
using bound_effect[OF good_interp, of "(Psubst a \<sigma>)" \<nu>, OF substSafe]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega> (- BVP (Psubst a \<sigma>))

goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> \<omega> (- BVP (Psubst a \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> Vagree \<nu> ?\<omega>7 (- BVP (Psubst a \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have sem_eq:"\<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow>
          (\<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) =
          (\<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> (\<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
using uadmit_fml_adjoint[OF FUA agree fsafe' ssafe good_interp]
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>) \<phi>

goal (1 subgoal):
 1. \<And>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> (\<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu>, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> (?\<omega>7 \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (?\<omega>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "(\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists> \<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "... = (\<exists> \<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjoint I \<sigma> \<omega>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
using IH1[OF fsafe' ssafe] IH2[OF hpsafe ssafe, of \<nu>]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
((\<nu>, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)

goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "... = (\<exists> \<omega>. (\<nu>, \<omega>) \<in> prog_sem (adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (adjoint I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using sem_eq IH2 hpsafe ssafe
[PROOF STATE]
proof (prove)
using this:
(\<nu>, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>) \<Longrightarrow> (?\<omega>7 \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (?\<omega>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>)
\<lbrakk>hpsafe a; ssafe \<sigma>\<rbrakk> \<Longrightarrow> ((?\<nu>7, ?\<omega>7) \<in> prog_sem I (Psubst a \<sigma>)) = ((?\<nu>7, ?\<omega>7) \<in> prog_sem (local.adjoint I \<sigma> ?\<nu>7) a)
hpsafe a
ssafe \<sigma>

goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>))
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>))
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>) \<and> \<omega> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>) = (\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
(\<exists>\<omega>. (\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a \<and> \<omega> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (\<langle> a \<rangle> \<phi>))

goal (3 subgoals):
 1. \<And>\<sigma> \<phi> a. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); Padmit \<sigma> a; hpsafe a \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem I (Psubst a \<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (local.adjoint I \<sigma> \<nu>) a)); FUadmit \<sigma> \<phi> (BVP (Psubst a \<sigma>)); hpsafe (Psubst a \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
 2. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 3. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (\<langle> a \<rangle> \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (\<langle> a \<rangle> \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (\<langle> a \<rangle> \<phi>))

goal (1 subgoal):
 1. fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (\<langle> a \<rangle> \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (\<langle> a \<rangle> \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (\<langle> a \<rangle> \<phi>)))

goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Prop1 \<sigma> args p p')
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = Some p'
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'
dsafe (Tsubst (args ?i7) \<sigma>)

goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe(Prop p args) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>.(\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
assume fsafe:"fsafe (Prop p args)"
       and ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
fsafe ($\<phi> p args)
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
from ssafe
[PROOF STATE]
proof (chain)
picking this:
ssafe \<sigma>
[PROOF STEP]
have ssafes:"(\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f')"
       "(\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')"
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')

goal (1 subgoal):
 1. (\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> dfree f') &&& (\<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> fsafe f')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SFunctions \<sigma> ?i7 = Some ?f'7 \<Longrightarrow> dfree ?f'7
SPredicates \<sigma> ?f7 = Some ?f'7 \<Longrightarrow> fsafe ?f'7

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
note TA = Fadmit_Prop1.hyps(1)
       and some = Fadmit_Prop1.hyps(2) and NFA = Fadmit_Prop1.hyps(3)
[PROOF STATE]
proof (state)
this:
Tadmit \<sigma> (args ?i7)
SPredicates \<sigma> p = Some p'
NFadmit (\<lambda>i. Tsubst (args i) \<sigma>) p'

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
from fsafe
[PROOF STATE]
proof (chain)
picking this:
fsafe ($\<phi> p args)
[PROOF STEP]
have safes:"\<And>i. dsafe (args i)"
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
using dfree_is_dsafe
[PROOF STATE]
proof (prove)
using this:
fsafe ($\<phi> p args)
dfree ?\<theta> \<Longrightarrow> dsafe ?\<theta>

goal (1 subgoal):
 1. \<And>i. dsafe (args i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i7)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have IH:"(\<And>\<nu>'. \<And>i. dsafe (args i) \<Longrightarrow>
         dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (adjoint I \<sigma> \<nu>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>' i. dsafe (args i) \<Longrightarrow> dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
using  subst_dterm[OF good_interp TA safes ssafes]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>i f'. SFunctions \<sigma> i = Some f' \<Longrightarrow> SFunctions \<sigma> (?i16 i f') = Some f'; \<And>f f'. SPredicates \<sigma> f = Some f' \<Longrightarrow> SPredicates \<sigma> (?f8 f f') = Some f'\<rbrakk> \<Longrightarrow> dterm_sem I (Tsubst (args ?i24) \<sigma>) ?\<nu> = dterm_sem (local.adjoint I \<sigma> ?\<nu>) (args ?i24) ?\<nu>

goal (1 subgoal):
 1. \<And>\<nu>' i. dsafe (args i) \<Longrightarrow> dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dsafe (args ?i7) \<Longrightarrow> dterm_sem I (Tsubst (args ?i7) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i7) \<nu>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have eqs:"\<And>i \<nu>'. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (adjoint I \<sigma> \<nu>) (args i) \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i \<nu>'. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by (auto simp add: IH safes)
[PROOF STATE]
proof (state)
this:
dterm_sem I (Tsubst (args ?i8) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i8) \<nu>

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
let ?sub = "(\<lambda> i. Tsubst (args i) \<sigma>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have subSafe:"(\<forall> i. dsafe (?sub i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i. dsafe (Tsubst (args i) \<sigma>)
[PROOF STEP]
by (simp add: safes ssafes tsubst_preserves_safe)
[PROOF STATE]
proof (state)
this:
\<forall>i. dsafe (Tsubst (args i) \<sigma>)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have freef:"fsafe p'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe p'
[PROOF STEP]
using ssafe some
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>
SPredicates \<sigma> p = Some p'

goal (1 subgoal):
 1. fsafe p'
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')
SPredicates \<sigma> p = Some p'

goal (1 subgoal):
 1. fsafe p'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe p'

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have IH2:"(\<nu> \<in> fml_sem I (FsubstFO p' ?sub)) = (\<nu> \<in> fml_sem (adjointFO I ?sub \<nu>) p')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO p' (\<lambda>i. Tsubst (args i) \<sigma>))) = (\<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p')
[PROOF STEP]
by (simp add: nsubst_fml [OF good_interp NFA freef subSafe])
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (FsubstFO p' (\<lambda>i. Tsubst (args i) \<sigma>))) = (\<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p')

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
have vec:"(\<chi> i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi> i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
[PROOF STEP]
apply(auto simp add: vec_eq_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
subgoal for i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
using IH[of i, OF safes[of i]]
[PROOF STATE]
proof (prove)
using this:
dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>

goal (1 subgoal):
 1. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<chi>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu>) = (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)

goal (1 subgoal):
 1. \<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))
[PROOF STEP]
using IH safes eqs
[PROOF STATE]
proof (prove)
using this:
dsafe (args ?i7) \<Longrightarrow> dterm_sem I (Tsubst (args ?i7) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i7) \<nu>
dsafe (args ?i7)
dterm_sem I (Tsubst (args ?i8) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args ?i8) \<nu>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))
[PROOF STEP]
apply (auto simp add:  IH2  some good_interp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'\<rbrakk> \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
 2. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = Some p'

goal (2 subgoals):
 1. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'\<rbrakk> \<Longrightarrow> Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)
 2. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>; Predicates (local.adjoint I \<sigma> \<nu>) p (\<chi>i. dterm_sem (local.adjoint I \<sigma> \<nu>) (args i) \<nu>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem (adjointFO I (\<lambda>i. Tsubst (args i) \<sigma>) \<nu>) p'
[PROOF STEP]
unfolding adjoint_def adjointFO_def
[PROOF STATE]
proof (prove)
using this:
SPredicates \<sigma> p = Some p'

goal (2 subgoals):
 1. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>; \<nu> \<in> fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (Tsubst (args f') \<sigma>) \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> p'\<rbrakk> \<Longrightarrow> Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> p (\<chi>i. dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>)
 2. \<lbrakk>\<And>i. dsafe (args i); \<And>i. dterm_sem I (Tsubst (args i) \<sigma>) \<nu> = dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>; Predicates \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> p (\<chi>i. dterm_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> (args i) \<nu>)\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem \<lparr>Functions = case_sum (Functions I) (\<lambda>f' _. dterm_sem I (Tsubst (args f') \<sigma>) \<nu>), Predicates = Predicates I, Contexts = Contexts I, Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> p'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) ($\<phi> p args))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe ($\<phi> p args); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst ($\<phi> p args) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) ($\<phi> p args))

goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Context1 \<sigma> \<phi> C C')
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = Some C'
PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'
fsafe (Fsubst \<phi> \<sigma>)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = Some C'
PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'
fsafe (Fsubst \<phi> \<sigma>)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have FA:"Fadmit \<sigma> \<phi>"
    and FUA:"FUadmit \<sigma> \<phi> UNIV"
    and some:"SContexts \<sigma> C = Some C'"
    and PFA:"PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'"
    and IH:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
    and substSafe:"fsafe(Fsubst \<phi> \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = Some C'
PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'
fsafe (Fsubst \<phi> \<sigma>)
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. (Fadmit \<sigma> \<phi> &&& FUadmit \<sigma> \<phi> UNIV &&& SContexts \<sigma> C = Some C') &&& PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C' &&& (\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))) &&& fsafe (Fsubst \<phi> \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = Some C'
PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
fsafe (Fsubst \<phi> \<sigma>)

goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (InContext C \<phi>) \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume safe:"fsafe (InContext C \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
from safe
[PROOF STATE]
proof (chain)
picking this:
fsafe (InContext C \<phi>)
[PROOF STEP]
have fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
fix \<nu> :: "'sz state"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have agree:"\<And>\<omega>. Vagree \<nu> \<omega> (-UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. Vagree \<nu> \<omega> (- UNIV)
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<forall>i. Inl i \<in> - UNIV \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> - UNIV \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> ?\<omega>7 (- UNIV)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have adj_eq:"\<And>\<omega>. fml_sem (adjoint I \<sigma> \<nu>) \<phi> = fml_sem (adjoint I \<sigma> \<omega>) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>
[PROOF STEP]
using uadmit_fml_adjoint[OF FUA agree fsafe ssafe good_interp]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>) \<phi>

goal (1 subgoal):
 1. \<And>\<omega>. fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have eq:"(\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using adj_eq IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
let ?sub = "(\<lambda>_. Fsubst \<phi> \<sigma>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
let ?R1 = "fml_sem I (Fsubst \<phi> \<sigma>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
let ?R2 = "fml_sem (adjoint I \<sigma> \<nu>) \<phi>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have eq':"?R1 = ?R2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>
[PROOF STEP]
using adj_eq IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have freef:"fsafe C'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fsafe C'
[PROOF STEP]
using ssafe some
[PROOF STATE]
proof (prove)
using this:
ssafe \<sigma>
SContexts \<sigma> C = Some C'

goal (1 subgoal):
 1. fsafe C'
[PROOF STEP]
unfolding ssafe_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>i f'. SFunctions \<sigma> i = Some f' \<longrightarrow> dfree f') \<and> (\<forall>f f'. SPredicates \<sigma> f = Some f' \<longrightarrow> fsafe f') \<and> (\<forall>f f'. SPrograms \<sigma> f = Some f' \<longrightarrow> hpsafe f') \<and> (\<forall>f f'. SODEs \<sigma> f = Some f' \<longrightarrow> osafe f') \<and> (\<forall>C C'. SContexts \<sigma> C = Some C' \<longrightarrow> fsafe C')
SContexts \<sigma> C = Some C'

goal (1 subgoal):
 1. fsafe C'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe C'

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have IH2:"(\<nu> \<in> fml_sem I (PFsubst C' ?sub)) = (\<nu> \<in> fml_sem (PFadjoint I ?sub) C')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')
[PROOF STEP]
using psubst_fml good_interp PFA fsafe substSafe freef
[PROOF STATE]
proof (prove)
using this:
is_interp ?I \<Longrightarrow> (PPadmit ?\<sigma> ?\<alpha> \<longrightarrow> hpsafe ?\<alpha> \<longrightarrow> (\<forall>i. fsafe (?\<sigma> i)) \<longrightarrow> (\<forall>\<nu> \<omega>. ((\<nu>, \<omega>) \<in> prog_sem ?I (PPsubst ?\<alpha> ?\<sigma>)) = ((\<nu>, \<omega>) \<in> prog_sem (PFadjoint ?I ?\<sigma>) ?\<alpha>))) \<and> (PFadmit ?\<sigma> ?\<phi> \<longrightarrow> fsafe ?\<phi> \<longrightarrow> (\<forall>i. fsafe (?\<sigma> i)) \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem ?I (PFsubst ?\<phi> ?\<sigma>)) = (\<nu> \<in> fml_sem (PFadjoint ?I ?\<sigma>) ?\<phi>)))
is_interp I
PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'
fsafe \<phi>
fsafe (Fsubst \<phi> \<sigma>)
fsafe C'

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have IH':"(\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (adjoint I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(?\<nu>8 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>8 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>8) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(?\<nu>8 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>8 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>8) \<phi>)
[PROOF STEP]
have IH:"fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (adjoint I \<sigma> \<nu>) \<phi>"
[PROOF STATE]
proof (prove)
using this:
(?\<nu>8 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>8 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>8) \<phi>)

goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>
[PROOF STEP]
using eq'
[PROOF STATE]
proof (prove)
using this:
(?\<nu>8 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>8 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>8) \<phi>)
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have duh:" (\<lambda>f' _. fml_sem I (case () of () \<Rightarrow> Fsubst \<phi> \<sigma>)) = (\<lambda> x (). fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>f' _. fml_sem I (case () of () \<Rightarrow> Fsubst \<phi> \<sigma>)) = (\<lambda>x (). fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by (simp add: case_unit_Unity eq' ext)
[PROOF STATE]
proof (state)
this:
(\<lambda>f' _. fml_sem I (case () of () \<Rightarrow> Fsubst \<phi> \<sigma>)) = (\<lambda>x (). fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have extend_PF:"(PFadjoint I ?sub) = (extendc I ?R2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>) = extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
unfolding PFadjoint_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (Fsubst \<phi> \<sigma>)), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> = extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using IH
[PROOF STATE]
proof (prove)
using this:
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>f' _. fml_sem I (Fsubst \<phi> \<sigma>)), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> = extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
apply (simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> \<Longrightarrow> case_sum (Contexts I) (\<lambda>f' _. fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>) = case_sum (Contexts I) (\<lambda>() _. fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by (metis old.unit.case old.unit.exhaust)
[PROOF STATE]
proof (state)
this:
PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>) = extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
SContexts \<sigma> C = Some C'

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (PFadjoint I ?sub) C')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')
[PROOF STEP]
using IH2
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (extendc I ?R2) C')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C')
[PROOF STEP]
using extend_PF
[PROOF STATE]
proof (prove)
using this:
PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>) = extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (extendc I ?R1) C')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C')
[PROOF STEP]
using eq'
[PROOF STATE]
proof (prove)
using this:
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C')

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> Contexts (adjoint I \<sigma> \<nu>) C (fml_sem (adjoint I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
using some
[PROOF STATE]
proof (prove)
using this:
SContexts \<sigma> C = Some C'

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
using this:
SContexts \<sigma> C = Some C'

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> C (fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> \<phi>))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>SContexts \<sigma> C = Some C'; \<nu> \<in> fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>() _. fml_sem I (Fsubst \<phi> \<sigma>)), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C'\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>() _. fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> \<phi>), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C'
 2. \<lbrakk>SContexts \<sigma> C = Some C'; \<nu> \<in> fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>() _. fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> \<phi>), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C'\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>() _. fml_sem I (Fsubst \<phi> \<sigma>)), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C'
[PROOF STEP]
apply (simp add: eq' local.adjoint_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>SContexts \<sigma> C = Some C'; \<nu> \<in> fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>() _. fml_sem \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> \<phi>), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C'\<rbrakk> \<Longrightarrow> \<nu> \<in> fml_sem \<lparr>Functions = Functions I, Predicates = Predicates I, Contexts = case_sum (Contexts I) (\<lambda>() _. fml_sem I (Fsubst \<phi> \<sigma>)), Programs = Programs I, ODEs = ODEs I, ODEBV = ODEBV I\<rparr> C'
[PROOF STEP]
by (simp add: eq' local.adjoint_def)
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "... = (\<nu> \<in> fml_sem (adjoint I \<sigma> \<nu>) (InContext C \<phi>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))
(\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')
(\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C')
(\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C')
(\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
(\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
show "(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))"
[PROOF STATE]
proof (prove)
using this:
(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>)))
(\<nu> \<in> fml_sem I (PFsubst C' (\<lambda>_. Fsubst \<phi> \<sigma>))) = (\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C')
(\<nu> \<in> fml_sem (PFadjoint I (\<lambda>_. Fsubst \<phi> \<sigma>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C')
(\<nu> \<in> fml_sem (extendc I (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) C') = (\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C')
(\<nu> \<in> fml_sem (extendc I (fml_sem I (Fsubst \<phi> \<sigma>))) C') = (\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
(\<nu> \<in> Contexts (local.adjoint I \<sigma> \<nu>) C (fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (InContext C \<phi>))

goal (2 subgoals):
 1. \<And>\<sigma> \<phi> C C'. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = Some C'; PFadmit (\<lambda>_. Fsubst \<phi> \<sigma>) C'; fsafe (Fsubst \<phi> \<sigma>)\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
 2. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (InContext C \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (InContext C \<phi>))

goal (1 subgoal):
 1. fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))

goal (1 subgoal):
 1. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
case (Fadmit_Context2 \<sigma> \<phi> C)
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = None
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = None
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))
[PROOF STEP]
have FA:"Fadmit \<sigma> \<phi>"
  and FUA:"FUadmit \<sigma> \<phi> UNIV"
  and none:"SContexts \<sigma> C = None"
  and IH:"fsafe \<phi> \<Longrightarrow> ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))"
[PROOF STATE]
proof (prove)
using this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = None
fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>))

goal (1 subgoal):
 1. (Fadmit \<sigma> \<phi> &&& FUadmit \<sigma> \<phi> UNIV) &&& SContexts \<sigma> C = None &&& (\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Fadmit \<sigma> \<phi>
FUadmit \<sigma> \<phi> UNIV
SContexts \<sigma> C = None
\<lbrakk>fsafe \<phi>; ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have "fsafe (InContext C \<phi>) \<Longrightarrow>
           ssafe \<sigma> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume safe:"fsafe (InContext C \<phi>)"
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fsafe (InContext C \<phi>)
[PROOF STEP]
have fsafe:"fsafe \<phi>"
[PROOF STATE]
proof (prove)
using this:
fsafe (InContext C \<phi>)

goal (1 subgoal):
 1. fsafe \<phi>
[PROOF STEP]
by (auto dest: fsafe.cases)
[PROOF STATE]
proof (state)
this:
fsafe \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
assume ssafe:"ssafe \<sigma>"
[PROOF STATE]
proof (state)
this:
ssafe \<sigma>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
fix \<nu>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have Ieq:" Contexts (local.adjoint I \<sigma> \<nu>) C = Contexts I C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Contexts (local.adjoint I \<sigma> \<nu>) C = Contexts I C
[PROOF STEP]
using none
[PROOF STATE]
proof (prove)
using this:
SContexts \<sigma> C = None

goal (1 subgoal):
 1. Contexts (local.adjoint I \<sigma> \<nu>) C = Contexts I C
[PROOF STEP]
unfolding adjoint_def
[PROOF STATE]
proof (prove)
using this:
SContexts \<sigma> C = None

goal (1 subgoal):
 1. Contexts \<lparr>Functions = \<lambda>f. case SFunctions \<sigma> f of None \<Rightarrow> Functions I f | Some f' \<Rightarrow> \<lambda>R. dterm_sem (extendf I R) f' \<nu>, Predicates = \<lambda>p. case SPredicates \<sigma> p of None \<Rightarrow> Predicates I p | Some p' \<Rightarrow> \<lambda>R. \<nu> \<in> fml_sem (extendf I R) p', Contexts = \<lambda>c. case SContexts \<sigma> c of None \<Rightarrow> Contexts I c | Some c' \<Rightarrow> \<lambda>R. fml_sem (extendc I R) c', Programs = \<lambda>a. case SPrograms \<sigma> a of None \<Rightarrow> Programs I a | Some x \<Rightarrow> prog_sem I x, ODEs = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEs I ode | Some x \<Rightarrow> ODE_sem I x, ODEBV = \<lambda>ode. case SODEs \<sigma> ode of None \<Rightarrow> ODEBV I ode | Some x \<Rightarrow> ODE_vars I x\<rparr> C = Contexts I C
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Contexts (local.adjoint I \<sigma> \<nu>) C = Contexts I C

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have IH':"\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
using IH[OF fsafe ssafe]
[PROOF STATE]
proof (prove)
using this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have agree:"\<And>\<omega>. Vagree \<nu> \<omega> (-UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. Vagree \<nu> \<omega> (- UNIV)
[PROOF STEP]
unfolding Vagree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. (\<forall>i. Inl i \<in> - UNIV \<longrightarrow> fst \<nu> $ i = fst \<omega> $ i) \<and> (\<forall>i. Inr i \<in> - UNIV \<longrightarrow> snd \<nu> $ i = snd \<omega> $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Vagree \<nu> ?\<omega>7 (- UNIV)

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
have adj_eq:"\<And>\<omega>. fml_sem (adjoint I \<sigma> \<nu>) \<phi> = fml_sem (adjoint I \<sigma> \<omega>) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<omega>. fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>
[PROOF STEP]
using uadmit_fml_adjoint[OF FUA agree fsafe ssafe good_interp]
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>) \<phi>

goal (1 subgoal):
 1. \<And>\<omega>. fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> \<omega>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>
[PROOF STEP]
have sem:"fml_sem I (Fsubst \<phi> \<sigma>) =  fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>"
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>
[PROOF STEP]
using IH' agree adj_eq
[PROOF STATE]
proof (prove)
using this:
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>
(?\<nu>7 \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) \<phi>)
Vagree \<nu> ?\<omega>7 (- UNIV)
fml_sem (local.adjoint I \<sigma> \<nu>) \<phi> = fml_sem (local.adjoint I \<sigma> ?\<omega>7) \<phi>

goal (1 subgoal):
 1. fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. \<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (\<And>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
show "?thesis \<nu>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
using none Ieq sem
[PROOF STATE]
proof (prove)
using this:
SContexts \<sigma> C = None
Contexts (local.adjoint I \<sigma> \<nu>) C = Contexts I C
fml_sem I (Fsubst \<phi> \<sigma>) = fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>

goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (InContext C \<phi>))

goal (1 subgoal):
 1. \<And>\<sigma> \<phi> C. \<lbrakk>Fadmit \<sigma> \<phi>; fsafe \<phi> \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst \<phi> \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) \<phi>)); FUadmit \<sigma> \<phi> UNIV; SContexts \<sigma> C = None\<rbrakk> \<Longrightarrow> fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (InContext C \<phi>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>fsafe (InContext C \<phi>); ssafe \<sigma>\<rbrakk> \<Longrightarrow> (?\<nu>7 \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (?\<nu>7 \<in> fml_sem (local.adjoint I \<sigma> ?\<nu>7) (InContext C \<phi>))

goal (1 subgoal):
 1. fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fsafe (InContext C \<phi>) \<longrightarrow> ssafe \<sigma> \<longrightarrow> (\<forall>\<nu>. (\<nu> \<in> fml_sem I (Fsubst (InContext C \<phi>) \<sigma>)) = (\<nu> \<in> fml_sem (local.adjoint I \<sigma> \<nu>) (InContext C \<phi>)))

goal:
No subgoals!
[PROOF STEP]
qed